Mark xstream dependency as provided

In DBZ-3365 the dependency for xstream.jar was adjusted but the change didn't maintain that the dependency is provided and thus caused the jar to be distributed and should not have. This should be adjusted.