Bump org.apache.logging.log4j:log4j-core in /modules/distribution

Bumps org.apache.logging.log4j:log4j-core from 2.18.0 to 2.25.3.

---
updated-dependencies:
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

modules/distribution/pom.xml

@@ -171,7 +171,7 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.18.0</version>
+            <version>2.25.3</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>

pom.xml

@@ -702,7 +702,7 @@
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-core</artifactId>
-                <version>2.24.1</version>
+                <version>2.25.3</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>