[SECURITY-362] Fix NPE when toggleOffline is performed by anonymous

Regression from SECURITY-362

[SECURITY-406] Prevent user creation via GET /user/whatever

[SECURITY-304] Encrypt new secrets with CBC and random IV instead of ECB

[SECURITY-392] JDKInstaller.DescriptorImpl.doPostCredential was unprotected

[SECURITY-383] Additional XStream2-specific class blacklisting

[SECURITY-349] Use updated stapler-adjunct-timeline for newer jquery

[SECURITY-362] Do not persist User in OfflineCause.UserCause

[SECURITY-382] Sign console notes with a MAC

[SECURITY-376] Remove backup directory for RekeySecretAdminMonitor

[SECURITY-358] Restrict access to metadata used by WorkflowRun

[SECURITY-388] Escape metacharacters in the search box

[SECURITY-389] Check ADMINISTER on /fingerprintCleanup and /workspaceCleanup

[SECURITY-385] Only suggest visible views in search

[SECURITY-321] Prevent existing items from being overwritten even if you cannot DISCOVER them

[SECURITY-343] Restrict API access to NodeMonitor data

[SECURITY-353] Persisted XSS in parameter definition names and value descriptions

(cherry picked from commit 441bf1c2)

[SECURITY-354] Using jBCrypt 0.4