We are replacing it by the ConfidentialStore class and the
ConfidentialKey class, which provides purpose-specific confidential
information that are separated from each other.

In this way, not all eggs are in one basket, and in case of a
compromise, the impact will contained.

Also replaced several insecure use of digest(secret|messsage) or
digest(message|secret) by HMAC.

while I can't pinpoint what's really causing this, moving this
dependency to core seems to solve the problem.

Guava is defined as dependency in org.kohsuke.stapler:stapler, then
redefined to a newer version in maven-plugin. The latter gets to plugins
as a test scope. When I look at the dependency scope of this in a plugin
project in IntelliJ IDEA, it reports this dependency as the test scope
(and this makes the error somewhat understandable.)