The problem is only Commons Lang, because Commons Collections is not useful anymore, because I think Adrian will remove the only class really used: ExtendedProperties.
About Commons Lang, at a first glance I noticed that the really needed classes are StringEscapeUtils and StringUtils.
But, about StringUtils, we need only "lame" methods (isEmpty, isNotEmpty, equals) that can be easily copied into the original StringUtils inside Velocity itself.
Now it's time of StringEscapeUtils. It is really useful, with the exception of escapeSql, that is pretty lame too (it replaces quotes with two quotes, nothing more). This method is problematic since it uses StringUtils.replace, that works differently to String.replaceAll (no regex allowed).
So I can try to shade StringEscapeUtils, Entities and UnhandledException, and let's see what happens