[SECURITY-343] Restrict API access to NodeMonitor data

[SECURITY-353] Persisted XSS in parameter definition names and value descriptions

(cherry picked from commit 441bf1c2)

[SECURITY-354] Using jBCrypt 0.4

[SECURITY-371] Secure all administrative monitors

Switch to requiring EXTENDED_READ permission for access to NodeMonitor
data. It might theoretically be better if we had more granular
permissions on each NodeMonitor, but that's a bigger change, and since
EXTENDED_READ is already what we use to limit access to serving the
computer's config.xml, I think this is appropriate.

[SECURITY-360] 2016/11/16 security fix for 1.625

Merge branch 'SECURITY-360-test' into security-stable-1.625

Extend ysoserial coverage for latest cases [SECURITY-317]

Make sure LDAPAttribute gets rejected.

[SECURITY-360] system property to disable CLI

This basically is a convenient version of
https://github.com/jenkinsci-cert/SECURITY-218.

During the course of discussing how to fix SECURITY-360, it was agreed
by the CERT team that we provide this switch.

[FIX SECURITY-170] Don't expose parameters not defined on the run