Commons codec dependency could be test scope only.

[sbearcsiro]

The Apache Commons Codec dependency appears to only be used in test classes:

$ grep -r --include "*.java" 'apache' .
./src/main/java/org/owasp/html/HtmlLexer.java:  // From http://issues.apache.org/jira/browse/XALANC-519
./src/test/java/org/owasp/html/AntiSamyTest.java:import org.apache.commons.codec.binary.Base64;

$ grep -r --include "*.java" 'commons.codec' .
./src/test/java/org/owasp/html/AntiSamyTest.java:import org.apache.commons.codec.binary.Base64;

If it was scoped as a test dependency then it wouldn't be transitively pulled into other projects that use this library, potentially causing conflicts between commons codec versions.