A truly conforming servlet 3.0 container does not allow us to set "secure cookie" flag beyond ServletContextListener.onInitialized().
If we see that, don't scare the users.

The commit message cannot really stand alone.

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

These items are meant for 1.584

Integrated the trilead with SecureRandom instantiation fix.

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

Integrated the newer version of Winstone

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

[FIXED JENKINS-25074] Make sure to call Job.getBuildHealthReports just once per t:buildHealth render.

Based on the reaction to these issues and JENKINS-24514, I'm partially
reverting the original change, and bringing the umask default back to
022.

The configurable option does enable the user to choose a different
umask, so I think I can still claim that JENKINS-24514 is addressed.

The primary change is that the thread name update code now lives in a
filter instead of 'Stapler' servlet, so it happens a lot earlier.

[FIXED JENKINS-22769] ItemListener callbacks should run as SYSTEM since they sometimes do ACL-checked calls.

The actual fix is made in 040b7d40
through winp.

This version checks the critical flag of the process, as killing such a
process results in BSoD.

Integrated the fix in remoting to Jenkins 1.580.