Bump XStream to 1.1.18 for better Java 16+ compatibility

On Java 16+, users still need to run the cleaner with JVM parameter
'--add-opens java.base/java.util=ALL-UNNAMED', but that is way better than the
multiple '--add-opens' statements needed for XStream 1.4.8.

pom.xml

@@ -144,7 +144,7 @@
 			<dependency>
 				<groupId>com.thoughtworks.xstream</groupId>
 				<artifactId>xstream</artifactId>
-				<version>1.4.8</version>
+				<version>1.4.18</version>
 				<exclusions>
 					<exclusion>
 						<artifactId>xmlpull</artifactId>

src/main/java/de/scrum_master/galileo/Book.java

@@ -7,6 +7,7 @@
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.io.xml.DomDriver;
 
+import com.thoughtworks.xstream.security.AnyTypePermission;
 import de.scrum_master.util.SimpleLogger;
 
 public class Book
@@ -23,6 +24,7 @@ public class Book
 	public final static XStream XSTREAM         = new XStream(new DomDriver());
 
 	static {
+		XSTREAM.addPermission(AnyTypePermission.ANY);
 		XSTREAM.alias("galileo-openbooks", TreeMap.class);
 		XSTREAM.alias("book", Book.class);
 		XSTREAM.alias("id", String.class);