fixed a flaky test
(cherry picked from commit 43ff1688eee6ea2f3f6438fd4812cd4a603ae13e)
[SECURITY-49] dependency changes needed for the fix.

(On trunk these commits are done separately as
72c68a22af7ad21ebbeb6b0857502779aa7c7a71
45b8f82e466bac0d033b1a9e145ea1b3df4861cd
31d2e03d478c7e30f8a5b05d8f3bd07b868d9525
[SECURITY-49] Deprecating Jenkins.getSecretKey()

We are replacing it by the ConfidentialStore class and the
ConfidentialKey class, which provides purpose-specific confidential
information that are separated from each other.

In this way, not all eggs are in one basket, and in case of a
compromise, the impact will contained.

Also replaced several insecure use of digest(secret|messsage) or
digest(message|secret) by HMAC.
(cherry picked from commit a9aff088f327278a8873aef47fa8f80d3c5932fd)

Conflicts:

	core/src/main/java/hudson/DNSMultiCast.java
	core/src/main/java/hudson/model/Job.java
	core/src/main/java/hudson/model/UsageStatistics.java
[SECURITY-49] added a tool to re-key secrets

As an AdministrativeMonitor, it shows up in the manage Jenkins UI, and
allows the administrator to run a re-keying operation.
(cherry picked from commit 4895eaafca468b7f0f1a3166b2fca7414f0d5da5)
[SECURITY-49] Backing off from @Extension-based discovery.

This is because we discovered some plugins that use Secret early on in
the initialization.
(cherry picked from commit c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2)
[SECURITY-49] mark secret.key generated by post SECURITY-49 Jenkins.

If JENKINS_HOME is created by a post SECURIT-49 Jenkins (LTS, and other
variants), then there's no need to alarm the user.
(cherry picked from commit 3dc13b957b14cec649036e8dd517f0f9cb21fb04)
[SECURITY-49] actively invalidate bad API tokens.

If the user still has the API token that's generated from secret.key,
don't accept that.

Hopefully this is the last fix
(cherry picked from commit 94a8789b699132dd706021a6be1b78bc47f19602)
[maven-release-plugin] prepare release jenkins-1.480.2
[maven-release-plugin] prepare for next development iteration
updated changelog as a part of the release