Third party categories

A [comment in JENKINS-1528](https://issues.jenkins-ci.org/browse/JENKINS-1528?focusedCommentId=178303&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-178303) notes that reports from `find-sec-bugs` are miscategorized. This patch seems to fix the problem.

I needed to rearrange the signatures of what should have been internal-only methods but which were marked `public`; did my best to minimize the disruption, short of creating actual `@Deprecated` copies of the originals.