[SECURITY-54] Massaging the original fix.

- Use the proper block cipher mode.
  Or else the information about the plain text still ends up revealing as a pattern without the attacker knowing the key.
- No need to hide SLAVE_SECRET from the encrypted payload.
  jnlpMac is needed to decrypt this payload to begin with, so there's no point in hiding it. This simplifies the code a little bit.
- Using a newer slave installer that uses the -secret option
Merge branch 'SECURITY-54'
Revert "bundling the newer JNA"

This reverts commit e216872238e8f2afad4b74ac025099de816f25c3.
Changelog for [JENKINS-16696]
[SECURITY-54]

Jesse's original patch
(cherry picked from commit 01a24e2cb1e885895c35fdf409c4305dcd877cd8)
[SECURITY-54] Massaging the original fix.

- Use the proper block cipher mode.
  Or else the information about the plain text still ends up revealing as a pattern without the attacker knowing the key.
- No need to hide SLAVE_SECRET from the encrypted payload.
  jnlpMac is needed to decrypt this payload to begin with, so there's no point in hiding it. This simplifies the code a little bit.
- Using a newer slave installer that uses the -secret option
(cherry picked from commit f4496df19e36465ae8d7cfebc6cde75f2888585b)
[SECURITY-13]
(cherry picked from commit 1fb2acfd7b7d2a492dc2f8a60c69b5e8236dcb52)

Conflicts:

	core/src/main/java/hudson/model/AbstractProject.java
	core/src/main/java/hudson/model/ParametersDefinitionProperty.java
[SECURITY-16]

Require POST for various operations.
(cherry picked from commit 36c8624379df32092d5d3163a853e040905302ea)

Conflicts:

	core/src/main/java/hudson/model/AbstractBuild.java
[FIXED SECURITY-46]
(cherry picked from commit f8d2a0ba6c2e261f48287bdd95bd7a2d7a8d2d0e)
[SECURITY-47]

- My second patch, with whitelisted XPath values and forbidden JSONP.
- Disabling JSONP altogether for REST API (unless explicitly allowed).
- Forbid primitive XPath result sets by default.
- Refuse to serve _crumb=123456 as this could (very hypothetically) be exploited.
(cherry picked from commit f4af9b1ab442ca912107d400caf4bb96635d64a5)

Conflicts:

	core/src/main/java/hudson/model/Api.java
[SECURITY-55]

This patch makes standard post-build action refuse to let you configure a downstream project you cannot currently build.
The one from parameterized-trigger will show an error in the configure screen but still lets you save the configuration; needs an analogous patch to that plugin.
Does not yet protect against POSTing config.xml with the trigger.
(cherry picked from commit 757bc8a53956e6fbab267214e6e0896f03c3c262)

Conflicts:

	core/src/main/java/hudson/model/Descriptor.java
Use jsStringEscape where necessary.
(cherry picked from commit 6d99c02b124ea3a1d76bd5762e8cab29018fd7cd)
[SECURITY-60] Upgrade Spring.
(cherry picked from commit b44df8b16a986a0f51e9b0415bde039d05f9e332)

Conflicts:

	core/pom.xml
Exclude NekoHTML and its concomitant obsolete Xerces.
(cherry picked from commit 20d628fa64751b0e7f71fac4acd35b5f42cbcbfd)
[FIXED JENKINS-16474]

Fixed the HTTP request thread saturation problem with Winstone.
(cherry picked from commit 4b1a95f23f19c57d8cf48ea0b1b30aaee541db27)

Conflicts:

	changelog.html
recording the change
Deprecating. Relates to a long-obsolete security model.
Strengthening regexp a bit.
Bumping up the dependency version.

This fixes two annotation-indexers from different groupIds to get
bundled.
[SECURITY-49] a9aff08 weakened the existing test; restoring it and introducing a separate test.