[JENKINS-16956] Enforce build trigger security

[JENKINS-16956](https://issues.jenkins-ci.org/browse/JENKINS-16956): ensure that the user associated a build (or the anonymous user, if unspecified) is able to see and build the downstream project.

Supersedes the placeholder fix of SECURITY-55 (and SECURITY-109): rather than checking permissions at job configuration time, rely on `QueueItemAuthenticator`s (such as that in the `authorize-project` plugin) to authorize us.

Also replaces pseudotriggers with a new true `Trigger` checking `Item.READ` on the upstream project from the perspective of the downstream project’s expected authentication. (Which incidentally supersedes `conditional-upstream-trigger-plugin`; that implementation was not usable here.)