[JENKINS-36871] Allow accessing instance identity from core

[JENKINS-36923] Give ownership of bcpkix dependency to bouncycastle-apl plugin

- We are committed to this now that bouncycastle-api 2.16.0 has been released

* [FIXED JENKINS-34882] Honor non-default update sites during install

* Fix pluginSetupWizard tests

* Fix lint

- We now check the format and assure that all detached plugins are reported

Adding a few nullability annotations

- We will be asking users who wish to ensure a secure path for their JNLP agents to validate the fingerprint before initial connection (which leverages TLS encryption of the http end-point and trust by the JNLP agent of the Jenkins Master's HTTPS TLS certificate)
- The fingerprint will then be used to validate the JNLP self-signed TLS certificate in order to ensure that the agent is talking to the master without fear of MiM
- We need to use self-signed TLS certificates for the JNLP connection as we need these to be unique to the Jenkins master and if we let users provide their own then they would end up re-using... in any case it is simpler to leverage the strength of the HTTPS TLS certificate as that is at least the one certificate that users have a hope of understanding how to validate.
- Thus we need a mechanism for users to verify the fingerprint. This root action provides that mechanism

[FIXED JENKINS-36922] Upgrade to instance-identity-module 2.0

[FIXED JENKINS-36732] Use build start times instead of build scheduled times in `BuildTimelineWidget`. (#2460)

Do not force the representation

- We migrate the bcpkix dependency from instance-identity to the war's WEB-INF/lib so that the net effect is zero and we are still not exposiing the bcpkix as a transitive dependency of jenkins-core

[JENKINS-34915] CLI commands wait-node-online/wait-node-offline extracted from core to CLI

[JENKINS-18435] Tell browsers not to cache or try to autocomplete forms

wait-node-online and wait-node-offline covered by test-cases