[SECURITY-167] Plugin manager was also vulnerable to XXE attacks.

Although the plugiun manager was vulnerable getting information
out of Jenkins was harder - however it would still be possible to
do bad things such as reading from /dev/zero on Linux

[SECURITY-162] Forbid symlink attacks from artifact archiving

[SECURITY-165] blacklist the document xpath function for use in Api

Review comments fixed:
 Added license header
 Reformat the issue comment
 Restricted NoExternalUse
 toLowerCase in English locale
 lesser resolution of declared exception from the test

@RandomlyFails

[SECURITY-166] Make UI tests work across Jenkins versions

[SECURITY-125] Matrix project script security

[SECURITY-167] Followup tweaks to address review comments.

Fixes for SECURITY-166

Addresses some comments received after the original fix was merged.

SECURITY-167

defend against XXE attacks in core https://issues.jenkins-ci.org/browse/SECURITY-167

Reproducible for example via HelpLinkTest.testMatrixConfig.
Otherwise have: matrix-project → script-security → matrix-auth → windows-slaves → antisamy-markup-formatter → matrix-project
Tried to come up with a generic way of doing this automatically, but failed.
Just because we bundle a particular build of some plugin does not mean it was built against anything recent,
and for use on older cores it may well need some of those implicit dependencies.

Otherwise FingerprinterTest.matrixDependency throws an AbstractMethodError.

(cherry picked from commit 0bd831e2)

(cherry picked from commit 747d550c)

(cherry picked from commit 9259f873)

(cherry picked from commit 071951e6)

(cherry picked from commit b628b472)

(cherry picked from commit 04aace98)

(cherry picked from commit e4ba41d5)

(cherry picked from commit 5d9e4d7b)

(cherry picked from commit b9d8f554)

(cherry picked from commit 42195d83)

(cherry picked from commit dbed3044)

Conflicts:
	core/src/main/java/hudson/model/Run.java

(cherry picked from commit d72fda46)

(cherry picked from commit e405078e)

(cherry picked from commit 4aad749c)

Conflicts:
	core/src/main/java/hudson/matrix/MatrixBuild.java
	core/src/main/java/hudson/matrix/MatrixConfiguration.java
	core/src/main/java/hudson/matrix/MatrixProject.java
	core/src/main/resources/hudson/matrix/MatrixProject/configure-entries.jelly