I believe that the primary resource requiring commons-logging is HttpClient. I haven't checked to see if it is required by any other dependencies.
The commons-logging dependency will normally be satisfied by the jars pulled in for logging – those other than slf4j-api, which is included in the .war file for Solr and solrj-lib for SolrJ. For the Solr server, this is satisfied by jcl-over-slf4j-1.7.7.jar ... which you can find in the Solr download at server/lib/ext, with the other logging jars. That jar captures calls to commons-logging and directs them through slf4j, which then sends them to whatever logging framework is bound.
Since 4.3, the bundled example server has used log4j 1.2 as the binding. Versions prior to 4.3 used java.util.logging, and the logging jars were bundled in the .war file.
If the user wants to actually use commons-logging for their slf4j binding, then they would not use jcl-over-slf4j-1.7.7.jar ... they would use the actual commons-logging jar and its dependencies. An additional jar would be required to redirect log4j through slf4j.
Some generic info about slf4j logging and Solr:
Just like the Solr server, SolrJ requires additional logging jars not included in solrj-lib. The reason they are not included there is because we do not know what kind of logging the user wants. They are free to choose whatever meets their needs. This probably needs a mention in the docs.