com.fasterxml.jackson.* has been removed from the policy repos, but was reintroduced into policy-gui.  It should be removed; gson (or, better, StandardCoderObject) should be used instead.

If this proves too difficult to do in the remaining time, we can move it to Honolulu, as it isn't a security issue; it's just an "Unknown license" issue.