Maven BOM and variable substitution support

[bensku]

Some dependencies cannot be downloaded before these are sorted out. This is usually not critical, as manually downloading (non-snapshot) jars in CI is easy enough.