[SECURITY-360] 2016/11/16 security fix for 1.625

Merge branch 'SECURITY-360-test' into security-stable-1.625

Extend ysoserial coverage for latest cases [SECURITY-317]

Make sure LDAPAttribute gets rejected.

[SECURITY-360] system property to disable CLI

This basically is a convenient version of
https://github.com/jenkinsci-cert/SECURITY-218.

During the course of discussing how to fix SECURITY-360, it was agreed
by the CERT team that we provide this switch.

[FIX SECURITY-170] Don't expose parameters not defined on the run

Backporting concurrentHashMapSerialization test removal from #2071, as it prevents use of JDK 8 to run core tests.

[SECURITY-266] Conceal ciphertext from users who could not resubmit it here

[SECURITY-243] Prefer id to fullName

Make it possible to disable SecurityRealm.loadUserByUsername call with a system property if it proves too slow in certain circumstances.

[FIX SECURITY-276] Don't allow open redirect using scheme-rel. URL

[SECURITY-281] Forbid /computer/(master)/config.xml