Review replacing usage of 'ant'

[hazendaz]

          The issue is not with Groovy per se, it is with Ant, which this mojo explicitly uses to run SpotBugs for some reason (merely using a Groovy utility to prepare the Ant usage). I filed https://github.com/apache/ant/pull/200 to deal with this upstream, though it would be better to drop the Ant dependency and either fork via `ProcessBuilder` or directly run the SpotBugs entry point class.

As far as I can tell the workaround is just to configure the mojo to fork—there is no need to set any special JVM arguments, since the System.setSecurityManager call is only used inside the Maven JVM when fork is false.

Originally posted by @jglick in #423 (comment)