Upgrade Shiro to 2.x

[pierre]

Update 20260801:

• We have shiro:2.2.1
• There's open PR to remove BearerToken (forked classes) in Kill Bill
• We need remove shiro from duplicate-finder-maven-plugin.

---

Because of https://issues.apache.org/jira/browse/SHIRO-679 (duplicate classes across artifacts), we cannot upgrade until 2.0.0 is released (apache/shiro#236).

Once we've upgraded, do we still need the forked classes in Kill Bill?

Also need to remove this config:

killbill-oss-parent/pom.xml

Line 2241 in f5d0681

<ignoredDependencies>

Related:

• https://issues.apache.org/jira/browse/SHIRO-435
• https://issues.apache.org/jira/browse/SHIRO-510
• https://issues.apache.org/jira/browse/SHIRO-540

[pierre]

Another reason to upgrade: https://issues.apache.org/jira/browse/SHIRO-501