replace reflections library (unmaintained) by classgraph.
This allows us to update Guava to current version (27.0.1) with its only dependency (failureaccess 1.0.1).