(cherry picked from commit 441bf1c2)

[SECURITY-354] Using jBCrypt 0.4

[SECURITY-371] Secure all administrative monitors

[SECURITY-360] 2016/11/16 security fix for 1.625

Merge branch 'SECURITY-360-test' into security-stable-1.625

Extend ysoserial coverage for latest cases [SECURITY-317]

Make sure LDAPAttribute gets rejected.

[SECURITY-360] system property to disable CLI

This basically is a convenient version of
https://github.com/jenkinsci-cert/SECURITY-218.

During the course of discussing how to fix SECURITY-360, it was agreed
by the CERT team that we provide this switch.

[FIX SECURITY-170] Don't expose parameters not defined on the run

Backporting concurrentHashMapSerialization test removal from #2071, as it prevents use of JDK 8 to run core tests.

[SECURITY-266] Conceal ciphertext from users who could not resubmit it here