Conflicts:
	test/src/test/java/hudson/model/UpdateCenter2Test.java

My plan is to remove this in a while.

With the server-side download, the test needs to induce the update
center metadata retrieval in a separate manner.

Conflicts:
	pom.xml

Conflicts:
	core/src/main/java/hudson/PluginManager.java
	core/src/test/java/hudson/PluginManagerTest.java

[SECURITY-167] Plugin manager was also vulnerable to XXE attacks.

Although the plugiun manager was vulnerable getting information
out of Jenkins was harder - however it would still be possible to
do bad things such as reading from /dev/zero on Linux

some language issues fixed

[JENKINS-26684] Escape special chars in maven build step arguments

[FIXED JENKINS-25953]Tabs in job view are layouted in wrong way

Conflicts:
	test/src/test/java/hudson/tasks/ArtifactArchiverTest.java

[SECURITY-162] Forbid symlink attacks from artifact archiving

Conflicts:
	core/src/main/java/hudson/model/Api.java
	test/src/test/java/hudson/model/ApiTest.java

[SECURITY-165] blacklist the document xpath function for use in Api

Review comments fixed:
 Added license header
 Reformat the issue comment
 Restricted NoExternalUse
 toLowerCase in English locale
 lesser resolution of declared exception from the test

Conflicts:
	test/src/test/java/hudson/tasks/BuildTriggerTest.java

@RandomlyFails

[SECURITY-166] Make UI tests work across Jenkins versions