Merge remote-tracking branch 'security/master'

Not sure why the CERT master branch has diverged from the
jenkinsci/jenkins master but Daniel thinks it's a side-effect of the
CERT branch handling script. Indeed only commits that are merging here
are merge commits themselves.