Exclude Apache Ivy from transitive dependencies

[ksobolew]

Description

We don't use it for anything, so it's only increasing our "attack surface" for vulnerabilities and such.

Additional context and related issues

Release notes

(x) This is not user-visible or docs only and no release notes are required.
( ) Release notes are required, please propose a release note for me.
( ) Release notes are required, with the following suggested text:

# Section
* Fix some things. ({issue}`issuenumber`)

[hashhar]

LGTM % comment

does this deserve a comment, over time it becomes impossible to know why a certain exclusion exists

[martint]

Adding exclusions is brittle. It means that every time we update a dependency, we need to check whether the exclusion is valid or not. It can also be included by other artifacts.

If it's not being used by Trino, there's no "attack surface" to increase, and this serves no other than to make security scanners happy. We want to make Trino secure, but it's not a goal to make scanners happy by working around their limitations and false positives.

If the dependency is truly irrelevant, then coral should be updated to not declare it as such.

[ksobolew]

#16994 would be the way to go