(cherry picked from commit 4f0200a0)

[FIXED SECURITY-69] Require POST to redeploy artifacts.(cherry picked from commit 3e56c3fc)

[SECURITY-63] Check RUN_SCRIPTS for /eval.(cherry picked from commit 3d03990a)

[SECURITY-63] Require POST for running Groovy scripts.(cherry picked from commit 3bbb65df)

[FIXED SECURITY-67] Forbid CSS links in markup to be on the safe side.(cherry picked from commit 1e19eb3e)

[JENKINS-16845] Refinement to hotfix: if build field has already been cleared due to earlier warning, do not throw a new NPE.

This bug indicates that people are having trouble understanding who's
responsible for aborting the build. This change records that
information through the logger.

A recent Stapler update caused the Jelly facet to ignore *.xml.
So need to use raw j:include (as plugins were doing), not st:include (as core did).

Most notable, cvs 1.6 → 2.8, to get the critical fix of removing the mail address resolver.

(cherry picked from commit 9858bf1e)