Upgrade to Log4j 2.9.1

This commit uppgrade our Log4j dependency to 2.9.1. It also modifies
ModifiedClassPathRunner so that log4j-*.jar jars are always excluded
from the class path when using the runner. This is necessary due to
a change in Log4j [1] which makes assumptions about the class loader
hierarchy that do not hold true when using the modified class path
runner. Specifically, it assumes that the system class loader should
always be used to load providers. This is exactly what we don't want
to happen when using the modified class path runner as it breaks the
filtering of the class path and leads to Log4j classes being loaded
from both the system class loader and the filtering class loader.

Closes gh-10407

[1] 9422ca7489

spring-boot-dependencies/pom.xml

@@ -131,7 +131,7 @@
 		<junit-platform.version>1.0.0</junit-platform.version>
 		<lettuce.version>5.0.0.RC2</lettuce.version>
 		<liquibase.version>3.5.3</liquibase.version>
-		<log4j2.version>2.9.0</log4j2.version>
+		<log4j2.version>2.9.1</log4j2.version>
 		<logback.version>1.2.3</logback.version>
 		<lombok.version>1.16.18</lombok.version>
 		<mariadb.version>2.1.1</mariadb.version>

spring-boot-tools/spring-boot-test-support/src/main/java/org/springframework/boot/testsupport/runner/classpath/ModifiedClassPathRunner.java

@@ -216,10 +216,13 @@ public class ModifiedClassPathRunner extends BlockJUnit4ClassRunner {
 		private final AntPathMatcher matcher = new AntPathMatcher();
 
 		private ClassPathEntryFilter(Class<?> testClass) throws Exception {
+			this.exclusions = new ArrayList<>();
+			this.exclusions.add("log4j-*.jar");
 			ClassPathExclusions exclusions = AnnotationUtils.findAnnotation(testClass,
 					ClassPathExclusions.class);
-			this.exclusions = exclusions == null ? Collections.<String>emptyList()
-					: Arrays.asList(exclusions.value());
+			if (exclusions != null) {
+				this.exclusions.addAll(Arrays.asList(exclusions.value()));
+			}
 		}
 
 		private boolean isExcluded(URL url) throws Exception {