There are several incompatibilities in XStream 1.4 that resulted in our
changing the core, but according to the text search on all the public
plugins, none of these changes affect the 600+ plugins we have today.

However, it is still possible that there are some parts of XStream 1.3
that plugins depend on but the core doesn't depend on --- we won't be
able to tell those problems at this point.

This fixes two annotation-indexers from different groupIds to get
bundled.

(cherry picked from commit b44df8b1)

Conflicts:

	core/pom.xml

This reverts commit e2168722.

We are replacing it by the ConfidentialStore class and the
ConfidentialKey class, which provides purpose-specific confidential
information that are separated from each other.

In this way, not all eggs are in one basket, and in case of a
compromise, the impact will contained.

Also replaced several insecure use of digest(secret|messsage) or
digest(message|secret) by HMAC.