Deprecate java.util.Timer

Bumping into V4 so we can see it, discuss it and do it or close it.

I've forgotten why we cared about this

Moving the conversation from where Scott said:

> Seems likely that we'll never be successful making all their code paths stop
> hanging, so probably the "real fix" here is just simply moving to a timer that
> uses cancellable work threads.

I'd concur with the some concerns

• I'd need to be convinced that cancellation involves "doing the right thing" with respect to unwind (we do not want a thread to exit with a lock held and have to rely on GC to release it)

• Its not immediately apparent to me what conditions we place on cancellation (when the next refresh is due)

• Finally, just because we cancel the thread, this doesn't mean that the operation won't just wedge in the same place next time.

The reference in MDA is in net.shibboleth.metadata.query.QueryController, which is part of aggregator-web-service. This is not part of the product yet, and will probably be replaced in some way by the mdq-server project code (which uses ScheduledThreadPoolExecutor).

I don't think there's a need to update the MDA code.