[JENKINS-19081] Offer the option of downloading metadata directly from the server

[JENKINS-19081](https://issues.jenkins-ci.org/browse/JENKINS-19081): downloading update center and tool metadata directly from the server is simpler and more reliable than hijacking untrusted browser windows, so offer the option to do so.

For now it retains the traditional behavior by default, especially as tool metadata like [hudson.tasks.Maven.MavenInstaller.json](http://ftp-chi.osuosl.org/pub/jenkins/updates/updates/hudson.tasks.Maven.MavenInstaller.json) bears no signature. (The `*.json.html` equivalent does, and the `*.json` for update centers does too, so this looks like an oversight; would I think currently break tool download from browsers without `postMessage` support.)