Not fully solved, since the scannedDirs field can still grow to be large, but at least clearing files/dirsNotIncluded.
Also imposing a 5s timeout on the scan regardless of file count, and defining a user-customizable bound.

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

[FIXED JENKINS-25400] Rework fix of JENKINS-22769 (c04cdcd9) to put the burden on each listener to impersonate ACL.SYSTEM if it needs to.

The original fix was made in 0c3d6709.
In this fix, I'm also moving the code that creates LeftItem.

It makes no sense that there's Item.cancel(Queue) and Queue.cancel(Item)
and they do different things!

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

A truly conforming servlet 3.0 container does not allow us to set "secure cookie" flag beyond ServletContextListener.onInitialized().
If we see that, don't scare the users.

Integrated the new winstone.jar for 1.585

The commit message cannot really stand alone.

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>

These items are meant for 1.584

Integrated the trilead with SecureRandom instantiation fix.

Signed-off-by: Oleg Nenashev <o.v.nenashev@gmail.com>