Update detached plugins to reflect security releases (#2817)

* [SECURITY-372] Update bundled mailer to 1.20.

* Updated to pick up other detached plugins mentioned in https://jenkins.io/security/advisory/2016-04-11/ or https://jenkins.io/security/advisory/2017-03-20/ while we are here.

* I18nTest.test_baseName_plugin caught that the detached version of credentials was too old to serve as a dependency.
Probably there should be some test case verifying that all detached plugins could be loaded at once,
though it would need to do a topological sort in dependency order.

* Must also include display-url-api as a detached plugin as it is a dependency, even though it was never actually detached from core.

* @oleg-nenashev insists on bundling display-url-api 2.0.