* [FIXED JENKINS-34882] Honor non-default update sites during install

* Fix pluginSetupWizard tests

* Fix lint

- We will be asking users who wish to ensure a secure path for their JNLP agents to validate the fingerprint before initial connection (which leverages TLS encryption of the http end-point and trust by the JNLP agent of the Jenkins Master's HTTPS TLS certificate)
- The fingerprint will then be used to validate the JNLP self-signed TLS certificate in order to ensure that the agent is talking to the master without fear of MiM
- We need to use self-signed TLS certificates for the JNLP connection as we need these to be unique to the Jenkins master and if we let users provide their own then they would end up re-using... in any case it is simpler to leverage the strength of the HTTPS TLS certificate as that is at least the one certificate that users have a hope of understanding how to validate.
- Thus we need a mechanism for users to verify the fingerprint. This root action provides that mechanism

[FIXED JENKINS-36732] Use build start times instead of build scheduled times in `BuildTimelineWidget`. (#2460)

wait-node-online and wait-node-offline covered by test-cases

* no longer hard-code the icon for the executor panel

[FIXED JENKINS-36775]

* add documentation to Computer.java for custom icons

* add recommended implementation to the javadoc

* [JENKINS-34468] CLI command offline-node extracted from core to CLI

offline-node extended to accept multiple node names
offline-node covered by test-cases

* Fixed translation properties

* Fixes based on Oleg's comments

* Fixed HelpCommandTest test-case

* Minor fixes

* Uses Matchers.instanceOf everywhere instead of Java operator instanceof

[JENKINS-36476] Underprivileged users could not use the default value of a password parameter (#2454)

* [FIXED JENKINS-36476] Do not even send the default password in encrypted form; leave the text field blank, and apply the default upon submission.

* [JENKINS-36476] Use a special token, not the empty string, as the marker for the default value.

* Fixed JENKINS-33201 [Java JSON exception with an empty parametrized
build.]

* FIXED JENKINS-33201. Changed to FormException instead of Failure

* That fix was never in a released version.

So it cannot have been reverted.

* Lowercase i for consistency

* Remove the concept of yanking dead executors.

* Another unnecessary call to doYank.

* [FIXED JENKINS-27530] Jenkins.reload must also reload the Queue to ensure that every Queue.Item.task corresponds to a live Job, lest nextBuildNumber be bogus.

* [JENKINS-27530] Noting #2439 & #2440.

* FIXED JENKINS-33201. Changed to FormException instead of Failure

* [FIXED JENKINS-33201 .FormException is thrown if parameterDefinitions are not available .

* Changing one more Tab to Space

* Moved checkForEmptyParameters to Job class

Setting autocomplete to "off" will tell browsers not to try to autofill
forms during history navigation. Since this seems to be a prominent
problem in Jenkins I feel it is best to have it default to "off" and let
individual inputs or pages opt-in to enable it instead
to indicate they can handle it.
The standard login page does not seem to use the taglib form tag
so it is not affected, even so, all modern browsers ignores
the autocomplete attribute on username and password fields anyway.

[FIXED JENKINS-25416][JENKINS-28790] Do not inject build variables into maven process optionally (#1976)

* [FIXED JENKINS-25416][JENKINS-28790] Do not inject build variables into maven process optionally

* [JENKINS-25416][JENKINS-28790] Fixed typo in test method name

* [JENKINS-25416][JENKINS-28790] Suggest alternatives in help

* [JENKINS-25416][JENKINS-28790] Use less hackish approach to preserving legacy behaviour

Divergence introduced with 117d69b8.

[FIXED JENKINS-36280] Enable DescriptorVisibilityFilter for Slave's ComputerLauncher, RetentionStrategy and NodeProperty

quiet-down and cancel-quiet-down covered by test-cases

[FIXED JENKINS-35641] - Always send usage statistics over HTTPs to the new usage.jenkins.io hostname(#2398)

References INFRA-559

[JENKINS-35098] Disable AutoBrowserHolder by default to improve the changelog rendering performance (#2371)

* [FIXED JENKINS-35098] Deleting AutoBrowserHolder.

* Normalizing form binding scheme for AbstractProject.scm.

* At @oleg-nenashev’s insistence, restoring AutoBrowserHolder, though not using it by default.

* Using SystemProperties at @oleg-nenashev’s recommendation.

[FIXED JENKINS-31915] Proxy settings in plugins page are ignored

* [FIXED JENKINS-34881] - handle non-default security settings for new installs

* Ensure permissions

* Initial security authentication token should still follow redirects

* Lithuanian translation update

* Lithuanian translation update

Optimize PNG images losslessly using zopflipng

* State label name as well in order to disambiguate when used from FormValidation#aggregate

* [JENKINS-31417] CLI command connect-node extracted from core to CLI

connect-node extended to accept multiple node names
connect-node covered by test-cases

* Slighty modified Javadoc

* Fixed translations after rebase

* [JENKINS-34244] Some UX improvements in the New item form
* [JENKINS-34244] Submit button has three-state behavior
* [JENKINS-34244] New helper methods were added to make easier the form validation. Focus behavior reviewed

* Handle legacy use of iconSize as a variable

When iconSize was set as a jelly variable, not passed as an attribute,
the value was not being normalized to an IconSizeClass. Fixes
JENKINS-25220.

* Evaluate attrs.iconSize explicitly.

Add Upgrade Wizard
Add 'replace' handlebars method in jenkins.js
Fix state transitions to follow a single basic pattern
Suggested plugins selected by default
Add an install state for INITIAL_SECURITY_SETUP
Removed duplicate setupWizard.js on page [FIX JENKINS-34676]
Exclude plugins which are already installed when determining platform
Change 'snooze' to not look like a 'close' button
Make sure unlock screen doesn't show up after new install
Add compatibility check when offering suggested plugins
More appropriate handling of security token filter