Go through Shiro dependencies and consider marking most third-party dependencies as provided

It's unlikely that users would use Shiro support modules to pull in a dependency to third-party libraries (such as Spring), but rather they explicitly declare the version they are dependent on. If we mark this dependencies as provided, we are forcing users to explicity declare those dependencies but at the same time, we avoid issues with potential version conflicts. What I don't like about this issue is that it's kind of open-ended, but I'll do a first pass before 1.0.0 and then close.