pushed the winstone dependency to the <dependencies> so that we can see the source code during debugging

earlier maven-hpi-plugin.

I think it's cumbersome to update the master POM every time we rev
maven-hpi-tools. I don't see why we can't set it here.

LDAP group names are now available as-is for the use in authorization. No upper casing / no 'ROLE_' prefix.

    A job without a firstBuild is not causing an NPE anymore.

build

logic to get remote settings.xml file, test in this order (as maven do)
1. configured alternateSettings
2. ~/.m2/settings.xml
3. $M2_HOME/conf/settings.xml