Verbatim tomcat dependencies must not be used

• User impact:

  Medium
• Similar Issues:

  None

Recent cookie enhancements in http transport added 2 tomcat depencies (tomcat-util & tomcat-apr), totalling about 300KB extra.

1. WHY tomcat 5.5, and not 6.0?
2. Without jar shading, it WILL conflict with tomcat jars bundled in jboss. What version wins and what hidden regressions may come out of it?

This should be reworked to use the latest available stable tomcat AND actual classes identified and bytecode-shaded (so they'll be in org.mule.org.apache.tomcat.util for example). This will guarantee to library version conflicts. Take a look at what e.g. MMC agent build does with some classes that we pull from the ant.jar.