Update and weaken Log4J2 dependency

[punya]

• Use the more recent 2.15.0 as baseline
• For the published package, express a provided dependency rather than actually pulling in Log4J2 ourselves