Upgrade ch.qos.logback dependency

Upgrade ch.qos.logback to version 1.2.9 to fix a JNDI-related vulnerability.

https://logback.qos.ch/news.html

logback-android is unaffected as it doesn't support JNDI. How sensible.

https://github.com/tony19/logback-android/issues/230