DO NOT MERGE: [JENKINS-23475] tests to demonstrate JENKINS-23475.

These are tests to reproduce [JENKINS-23475] (https://issues.jenkins-ci.org/browse/JENKINS-23475), permission check can be bypassed with WebAPI (and also with CLI).
Specifying project names without variables (that is, statically), permission checks are performed at configuration time, but they are not performed for WebAPI and CLI.

Test will fail for this pull request.