Is your feature request related to a problem?
During review of #2927, @cwperks mentioned that the main reason of why we still use HTTP commons 4 is SamlHTTPMetadataResolver which reads IDP metadata file and track the state of it.
The new version 4.3.0 still use HTTP commons 4 though.

What solution would you like?
To exclude HTTP commons 4 completely there are 2 options exists:

1. Implement our own solution which will use HTTP common 5. For that we need to extend org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver and implement almost the same logic as org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver which SamlHTTPMetadataResolver extends.
2. Try to prepare PR in Shibboleth repository with new version (do not know what is the process since repo is not GiHub one)