Track Apache Log4j advisories

[pombredanne]

See https://logging.apache.org/log4j/2.x/security.html
It graduated to be tracked on its own.

[TG1999]

It's in CycloneDX json format https://logging.apache.org/log4j/2.x/security.html#vulnerabilities