[SECURITY-171] XSS in FormValidation._error(..., Throwable, ...)

[SECURITY-180] arbitrary API Token change/leak via changeToken

With the server-side download, the test needs to induce the update
center metadata retrieval in a separate manner.

[SECURITY-167] Plugin manager was also vulnerable to XXE attacks.

Although the plugiun manager was vulnerable getting information
out of Jenkins was harder - however it would still be possible to
do bad things such as reading from /dev/zero on Linux

[SECURITY-162] Forbid symlink attacks from artifact archiving

[SECURITY-165] blacklist the document xpath function for use in Api

Review comments fixed:
 Added license header
 Reformat the issue comment
 Restricted NoExternalUse
 toLowerCase in English locale
 lesser resolution of declared exception from the test

@RandomlyFails

[SECURITY-166] Make UI tests work across Jenkins versions

[SECURITY-125] Matrix project script security

[SECURITY-167] Followup tweaks to address review comments.

Fixes for SECURITY-166

Addresses some comments received after the original fix was merged.

SECURITY-167

defend against XXE attacks in core https://issues.jenkins-ci.org/browse/SECURITY-167

Reproducible for example via HelpLinkTest.testMatrixConfig.
Otherwise have: matrix-project → script-security → matrix-auth → windows-slaves → antisamy-markup-formatter → matrix-project
Tried to come up with a generic way of doing this automatically, but failed.
Just because we bundle a particular build of some plugin does not mean it was built against anything recent,
and for use on older cores it may well need some of those implicit dependencies.

Otherwise FingerprinterTest.matrixDependency throws an AbstractMethodError.

(cherry picked from commit 0bd831e2)

(cherry picked from commit 747d550c)

(cherry picked from commit 9259f873)

(cherry picked from commit 071951e6)

(cherry picked from commit b628b472)

(cherry picked from commit 04aace98)

(cherry picked from commit e4ba41d5)

(cherry picked from commit 5d9e4d7b)