fixed a flaky test
(cherry picked from commit 43ff1688eee6ea2f3f6438fd4812cd4a603ae13e)
[SECURITY-49] dependency changes needed for the fix.

(On trunk these commits are done separately as
72c68a22af7ad21ebbeb6b0857502779aa7c7a71
45b8f82e466bac0d033b1a9e145ea1b3df4861cd
31d2e03d478c7e30f8a5b05d8f3bd07b868d9525
[SECURITY-49] Deprecating Jenkins.getSecretKey()

We are replacing it by the ConfidentialStore class and the
ConfidentialKey class, which provides purpose-specific confidential
information that are separated from each other.

In this way, not all eggs are in one basket, and in case of a
compromise, the impact will contained.

Also replaced several insecure use of digest(secret|messsage) or
digest(message|secret) by HMAC.
(cherry picked from commit a9aff088f327278a8873aef47fa8f80d3c5932fd)

Conflicts:

	core/src/main/java/hudson/DNSMultiCast.java
	core/src/main/java/hudson/model/Job.java
	core/src/main/java/hudson/model/UsageStatistics.java
[SECURITY-49] added a tool to re-key secrets

As an AdministrativeMonitor, it shows up in the manage Jenkins UI, and
allows the administrator to run a re-keying operation.
(cherry picked from commit 4895eaafca468b7f0f1a3166b2fca7414f0d5da5)
[SECURITY-49] Backing off from @Extension-based discovery.

This is because we discovered some plugins that use Secret early on in
the initialization.
(cherry picked from commit c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2)
[SECURITY-49] mark secret.key generated by post SECURITY-49 Jenkins.

If JENKINS_HOME is created by a post SECURIT-49 Jenkins (LTS, and other
variants), then there's no need to alarm the user.
(cherry picked from commit 3dc13b957b14cec649036e8dd517f0f9cb21fb04)
[SECURITY-49] actively invalidate bad API tokens.

If the user still has the API token that's generated from secret.key,
don't accept that.

Hopefully this is the last fix
(cherry picked from commit 94a8789b699132dd706021a6be1b78bc47f19602)
[maven-release-plugin] prepare release jenkins-1.480.2
[maven-release-plugin] prepare for next development iteration
updated changelog as a part of the release
[JENKINS-16069] Remove wrapping of JSON with ( )
now it is done properly on Javascript side so the current server
implementation triggers javascript errors.

Result can be observed on DynamicComboBox within ui-samples-plugin(cherry picked from commit b6ce03878ed7523878ceffdb69e699c19a941bfc)

Conflicts:
	changelog.html
Fixed the lock contention problem on Queue.getItems()

From what I was told by Emanuele today in the office hours, this came up
during the Copenhagen hackathon.
(cherry picked from commit f1aa7ba07e3fa5ddf34888a7f10bf04a56de1c74)

Conflicts:
	changelog.html
[FIXED JENKINS-15335] Typo broke build queue display.(cherry picked from commit 6c4e65f576ea6fa43b06e6d677f40410a87fefc1)
[JENKINS-16468] Linking in changelog.
(cherry picked from commit 2f1ad0b2fbad9bb81ebbf1d0df08a24dcb3f0f16)

Conflicts:
	changelog.html
[JENKINS-16468] Marking as a bug, not an RFE.
(cherry picked from commit a156f1ebc610eae0e6e2316576d6f97a0180986b)

Conflicts:
	changelog.html
[FIXED JENKINS-13536] Using file parameters could cause build records to not load.
Solves the issue for newly created builds by not attempting to persist the original file upload record, which is useless after the build has run (the fileParameters dir in the build already archives them).
Does not help loading pre-fix builds in which the upload temp file has been deleted; for these, you must manually delete <file class="org.apache.commons.fileupload.disk.DiskFileItem" serialization="custom">…</file> from the build.xml.
(Did not find a straightforward way to just instruct XStream to ignore this bit of XML: it is easy to avoid serializing a field, but deserializing is different.)(cherry picked from commit 4dde24e62037439b7b73addd7cefae83a254eb3c)

Conflicts:
	changelog.html