Audit dependencies for Category-X

Recently phoenix has found some category-x dependencies in their build (PHOENIX-3084, PHOENIX-3091), which also showed some problems in HBase (HBASE-16260).

Since the Timeline Server work brought in both of these as dependencies, we should make sure we don't have any cat-x dependencies either. From what I've seen in those projects, our choice of HBase version shouldn't be impacted but our Phoenix one is.

Greping our current dependency list for the timeline server component shows some LGPL:

...
[INFO]    net.sourceforge.findbugs:annotations:jar:1.3.2:compile
...

I haven't checked the rest of the dependencies that have changed since HADOOP-12893 went in, so ATM I've filed this against YARN since that's where this one example came in.