[SECURITY-360] 2016/11/16 security fix for 1.625

Merge branch 'SECURITY-360-test' into security-stable-1.625

Extend ysoserial coverage for latest cases [SECURITY-317]

Make sure LDAPAttribute gets rejected.

[SECURITY-360] system property to disable CLI

This basically is a convenient version of
https://github.com/jenkinsci-cert/SECURITY-218.

During the course of discussing how to fix SECURITY-360, it was agreed
by the CERT team that we provide this switch.

* [FIX JENKINS-18114] Exclude /cli URL from crumb requirement

* [JENKINS-18114] Fix test: Don't send the crumb

The CLI doesn't do this either.

(cherry picked from commit de740c75)

* [JENKINS-37874] - Log SEVERE messages if Jenkins does not reach COMPLETED stage during startup or reload

* [JENKINS-37874] - Add Administrative monitor for the COMPLETED state

* [JENKINS-37874] - Polish log messages

(cherry picked from commit 0f45609f)

[FIXED JENKINS-38473] Set a short timeout on the socket when using it to wake the acceptor thread. (#2564)

* [FIXED JENKINS-38473] Set a short timeout on the socket when using it to wake the acceptor thread.

* [JENKINS-38473] Remove leftover typing in wrong window

(cherry picked from commit 1689f6b7)

Diff: https://github.com/jenkinsci/extras-executable-war/compare/executable-war-1.33...executable-war-1.34

* https://issues.jenkins-ci.org/browse/JENKINS-23232
* https://issues.jenkins-ci.org/browse/JENKINS-34287
(cherry picked from commit 24443acb3c92612dc623849c9458000c98a0a265)

[FIXED JENKINS-38534] Isolate the code that requires the `Jenkins` class to be loaded from an agent code path

(cherry picked from commit 08595737)

* [JENKINS-35184] Servlet API dependent bits in a inner-class

This is in order to avoid loading ServletContextListener class
from slaves classloader.

* [JENKINS-35184] Don't use SystemProperties while initializing remote agents

This rolls back the previous commit and introduces a new way to construct
RingBufferLogHandler which avoids relying on SystemProperties to get the
default size.

* [JENKINS-35184] Mark SystemProperties as OnMaster only class

Adding `OnMaster` annotation does not prevent the class from being
loaded on remote agent but it gives a hint that this class should not
be used on a remote agent.

* [JENKINS-35184] Set SLAVE_LOG_HANDLER at the very beginning

In the previous code cleaning existing log handlers, SLAVE_LOG_HANDLER
is always null, as static fields are scoped by classloader.

(cherry picked from commit 27d9b73e)

There were two issues preventing the build history from updating properly:
1) The next build number being fetched wasn't taking into account running builds, so any builds already running when the page is refreshed would be ignored. The fix was to use nextBuildNumberToFetch if it is available (which is the case if there are running builds) and to fall back to the next build otherwise.
2) The first transient build key (used to clear out builds from the history that are being updated) wasn't being set when the page first loads. This was fixed by making getHistoryPageFilter calculate the value so that it happens in all cases rather than just during the ajax call.
(cherry picked from commit 0268b988)