[JENKINS-45387] Fix validation error displaying in setup wizard's "create first admin" form (#3116)

* [JENKINS-45387] Improve setup wizard account creation in security realm

This commit adds an additional account creation method to the
security realm, that allows to create a new user account (as the system)
and is intended to be used by the setup wizard.

The main difference to the existing method is that the new method does
not force the Stapler to send a response, but instead throws an
exception if invalid data is submitted. This allows to call this from
the setup wizard, and send the response there. (This is necessary
because the setup wizard method has a response return type and
there is no way to access the response already send in the realm)

Further, it splits the private createAccount() method for
clarity as well as to allow code reuse from the new method.

* [JENKINS-45387] Fix SetupWizard sending responses twice on create admin

This commit fixes an issue where the SetupWizard class would send
two responses (indirectly) when invalid form data was provided for
creating the first admin account.

* [Fix JENKINS-45387] Setup wizard not displaying first account errors

This commit fixes the setup wizard not displaying HTML error
responses upon first account creation.

Previously, it just froze (buttons were not re-enabled) and didn't
display responses. (Probably caused by XSS policies on the iframe)

* [JENKINS-45387] Add some @Restricted annotations

As per
https://github.com/jenkinsci/jenkins/pull/3116#discussion_r172031063
https://github.com/jenkinsci/jenkins/pull/3116#discussion_r172051979