JENKINS-21160: update pom.xml to warn about mismatched args4j

in some circumstances, you may use some older args4j (coming from remoting) when the jenkins about page shows a different version.
Make node provisioning strategy plugable
Clarify the lock semantics
Narrow the scope of lock required to get the pending nodes.

- Too many things have incorrect locking assumptions on calling NodeProvisioner#getPendingLaunches()
- Simpler to narrow the lock requirements as that should prevent deadlocks
- We now only need the lock for a very short window and the lock is only on the list of pending launches.
typos
Fix syntax in Javadoc comment
Tidy up javadoc some more
[FIXED JENKINS-15252] Explain problems with CSRF protection
move config file check as part of loading job to do it in multithread fashion than in a single thread
the trunk is toward 1.588-SNAPSHOT
Merge pull request #1438 from daniel-beck/JENKINS-15252

[FIXED JENKINS-15252] Explain problems with CSRF protection
Merge pull request #1419 from dnozay/patch-1

JENKINS-21160: update pom.xml to warn about mismatched args4j
Merge pull request #1433 from stephenc/master

Refactor NodeProvisioner to allow for extension of strategies
fix @since tags
Prevent a storm of node monitor updates when there is a storm of nodes coming on line within 1 second

- The old code would result in multiple triggered updates, with corresponding interrupts of in-progress updates
  when faced with lots of slaves coming on line within 1 second of each other.

- New code will ensure that one and only one of the scheduled tasks (i.e. the last one) will trigger the updates.
If you are synchronizing on something to access a volatile, then you are doing something wrong

- Yet more interrupting bad patterns, especially where we expect the node monitor to take up to 30 seconds to complete if an async variety
fromExternalizableId should just return null, not throw IAE, if the job has since been renamed/move/deleted.
(It could already return null if the run has since been deleted; #1264 failed to mark this properly.)
Reserving IAE for inputs that getExternalizableId could not actually have produced,
and making sure to also throw this in case of non-numeric text after the hash.
Adding Javadoc for both methods.
Make it possible for sub-classes to have a sub-class specific trust anchor chain
Adjust my prior change to better utilize structured form submission to accomodate a few plugins that are improperly submitting data through this processing logic
Merge branch 'custom-workspace' of github.com:mattmoor/jenkins