Add log4j1 dependabot ignore entry (#5245)

Any other dependencies with the same coordinates are unofficial releases
that would likely be in violation of Apache trademarks anyways as Log4j
1.2.17 is the official final release of 1.x and has been for over five
years.