Issue title: Your project intuit/karate is using buggy third-party libraries [WARNING]
 Issue body: Hi, there!
We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions.    
We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information.
  1  org.apache.httpcomponents httpclient (karate-apache/pom.xml)
  version: 4.5.5

  Jira issues:
  connection leak issue when OutOfMemory
  affectsVersions:4.5.3,4.5.4,4.5.5
  https://issues.apache.org/jira/projects/HTTPCLIENT/issues/HTTPCLIENT-1924?filter=allopenissues




  2  commons-io commons-io (karate-demo/pom.xml,karate-demo/build.gradle)
  version: 2.5

  Jira issues:
  ant test fails - resources missing from test classpath
  affectsVersions:2.5
  https://issues.apache.org/jira/projects/IO/issues/IO-451?filter=allopenissues
  Exceptions are suppressed incorrectly when copying files.
  affectsVersions:2.4;2.5
  https://issues.apache.org/jira/projects/IO/issues/IO-502?filter=allopenissues
  ThresholdingOutputStream.thresholdReached() results in FileNotFoundException
  affectsVersions:2.5
  https://issues.apache.org/jira/projects/IO/issues/IO-512?filter=allopenissues
  Tailer.run race condition runaway logging
  affectsVersions:2.5
  https://issues.apache.org/jira/projects/IO/issues/IO-528?filter=allopenissues
  Thread bug in FileAlterationMonitor#stop(int)
  affectsVersions:2.5
  https://issues.apache.org/jira/projects/IO/issues/IO-535?filter=allopenissues
  2.5 ExceptionInInitializerError
  affectsVersions:2.5
  https://issues.apache.org/jira/projects/IO/issues/IO-536?filter=allopenissues




  3  ch.qos.logback logback-classic (pom.xml)
  version: 1.2.3

  Jira issues:
  missing log files and log entries when using SizeAndTimeBasedRollingPolicy 
  affectsVersions:1.2.3
  https://jira.qos.ch/projects/LOGBACK/issues/LOGBACK-1361?filter=allopenissues




Sincerely~
FDU Software Engineering Lab
Jan 7th,2019
 Comments: 
 Comment 0: @FDU-SE-LAB thanks for the useful info ! I'm treating as wont-fix for the following reasons:

1) org.apache.httpcomponents httpclient (karate-apache/pom.xml)
This is a test-automation tool, not prod infrastructure so the OOM edge case is acceptable. we also have `karate-jersey` as an option

2) commons-io commons-io (karate-demo/pom.xml,karate-demo/build.gradle)
This is a demo example

3) ch.qos.logback logback-classic (pom.xml)
This is indeed used in core, but again as this is a test-automation tool, this is acceptable - especially since we don't use a rolling strategy by default in the docs / [examples](https://github.com/intuit/karate/blob/master/karate-junit4/src/test/java/logback-test.xml) / quickstart: 
{'source': 'GithubIssues', 'repo_name_with_owner': 'intuit/karate', 'issue_id': 396337748, 'repo_stars': 5304.0}