[FIXED JENKINS-21023] Rewrote WorkspaceCleanupThread to determine where workspaces for known items should be, rather than looking for directories that look like they might be workspaces.
One key advantage is that this correctly handles the new default workspace location on the master.
Another is that this allows folders to be correctly skipped, and jobs in folders to be correctly deleted.
A subtler advantage would be handling of configured nondefault workspace locations, and compatibility with WorkspaceLocator.
(Orphaned workspaces from deleted jobs are not removed, but these were not removed before either.)

If it's significant enough to introduce regressions, it's significant enough for the changelog.

My recommended fix in response to https://github.com/jenkinsci/jenkins/pull/1093. This does not eliminate nor exclude the need for more generic pluggability, but it would at least address the security concern.

[FIXED JENKINS-18694] Generalizing fix of JENKINS-18678 to include also rename of parent folders, taking advantage of JENKINS-18028 API.

[FIXED JENKINS-20008] [FIXED JENKINS-18028] [FIXED JENKINS-18680] #1069: support for moving jobs into or out of folders.

[FIXED JENKINS-19826] element.setAttribute('name', …) does not work in IE in compatibility mode, so use prototype’s Element(…) which does.

[FIXED JENKINS-21254] Ensuring that all <link>s offered on the /login page can be read even by anonymous users without Jenkins.READ.

[JENKINS-18410] NPE from previous fix (fcdf7499) under some conditions, which the test case was not exercising.
java.lang.NullPointerException
	at hudson.tasks.test.AggregatedTestResultPublisher$TestResultAction.getProject(AggregatedTestResultPublisher.java:173)
	at hudson.tasks.test.AggregatedTestResultPublisher$TestResultAction.<init>(AggregatedTestResultPublisher.java:146)
	at hudson.tasks.test.AggregatedTestResultPublisher$TestResultAction.<init>(AggregatedTestResultPublisher.java:135)
	at hudson.tasks.test.AggregatedTestResultPublisher.perform(AggregatedTestResultPublisher.java:90)

[JENKINS-18678] Tweaking API, adding @since & changelog for #1075, fixing purgeCache so that test can pass.

[FIXED JENKINS-21024] Catch a full range of XStreamException’s during deserialization, including rethrown exceptions from readResolve.