ARROW-1242: [JAVA] - upgrade jackson to mitigate security vulnerabilities

[mattdarwin]

As per #872 I am upgrading Jackson to the latest version on the current train (2.7.1 --> 2.7.9)

[wesm]

@StevenMPhillips @siddharthteotia does this seem OK to you?

[wesm]

@mattdarwin since we haven't had enough review of this and the other patch ARROW-1243, I am not comfortable pulling this into 0.6.0 until the change has been vetted more carefully (e.g. in Spark). I am not an expert at all in these matters. @BryanCutler @holdenk can you assist with vetting these dependency upgrades?

If these libraries pose an issue for users of 0.6.0 we can discuss making a patch release, otherwise they can wait for 0.7.0 (probably releasing in a 6-8 week horizon, at most)

[jacques-n]

LGTM +1.

[BryanCutler]

Thanks for the heads up @wesm . In Spark an older version of jackson is being used and the Arrow jackson dependencies are excluded, so it wouldn't pull in anything new. Since the usage hasn't changed here, everything should still work but I'll test it out just to be sure.

[mattdarwin]

I made a mistake and the PR didn't successfully upgrade the Jackson version. Let's see if I can reopen this PR, otherwise I will file a new one