[#4843] Bump org.apache.commons:commons-configuration2 from 1.10 to 2.12.0

[qinlonglong123]

Bump org.apache.commons:commons-configuration2 from 1.10 to 2.12.0
Fixes #4843

Follow this checklist to help us incorporate your contribution quickly and easily:

• Make sure there is a JIRA issue filed for the change (usually before you start working on it). Trivial changes like typos do not require a JIRA issue. Your pull request should address just this issue, without pulling in other changes.
• Each commit in the pull request should have a meaningful subject line and body.
• Format the pull request title like [SCB-XXX] Fixes bug in ApproximateQuantiles, where you replace SCB-XXX with the appropriate JIRA issue.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Run mvn clean install -Pit to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

---

[liubao68]

2.8.x dependends on Archaius which dependends on commons-configuration. You can not upgrade commons-configuration without making a incompatible change like 3.x.

We removed Archaius support totally in 3.x, see https://servicecomb.apache.org/references/java-chassis/zh_CN/introduce3.x.x.html