pushed the winstone dependency to the <dependencies> so that we can see the source code during debugging

earlier maven-hpi-plugin.

I think it's cumbersome to update the master POM every time we rev
maven-hpi-tools. I don't see why we can't set it here.

LDAP group names are now available as-is for the use in authorization. No upper casing / no 'ROLE_' prefix.

    A job without a firstBuild is not causing an NPE anymore.