JenkinsRule.createMatrixProject is public now.
Deleting GroovyScriptPath, pending an administrator-controlled replacement in script-security-plugin.
It proved trivial to attack the system using a custom library with @Whitelisted methods.