Make sure all tests use reproducible versions

[ctrueden]

Some tests use groupId:artifactId endpoints with no version specified. This is not guaranteed to be reproducible over time: tests that previously passed might start breaking due to Java-side code changes. We should change all tests to use specific versions.

The only exception is: we probably need one test that specifically does not specify the version, just to make sure it keeps working. For that, we can choose an artifact that is highly unlikely to ever be published again; perhaps a project that has since renamed its groupId or artifactId, like org.apache.commons:commons-math:2.2, which was last published in 2011, and has since moved on to org.apache.commons:commons-math3 (last published in 2016) and commons-math4 (not yet released).