Address some vulnerabilities from IQ report

Address some vulnerabilities from IQ report

Upgraded the version of a couple of items reported in IQ.  The new
versions are likely to have the same issues, but at least it should be
good for a moment.

Verified that the change to json-smart did not cause the CDS Actor tests
to break.  (Though it should eventually be tested with a real CDS.)
Verified that the change to xstream did not cause any tests in
drools-pdp or drools-apps to break.

Issue-ID: POLICY-3431
Change-Id: I1419871577174fd986c9eebf2ce35134bd4bda93
Signed-off-by: Jim Hahn <jrh3@att.com>