* core/src/main/resources/lib/form/combobox/combobox.js
  Increase index to 100, so that parent form elements can be initialized before
  parameters in fillDependsOn are extracted.

* test/src/test/java/lib/form/ComboBoxTest.java
* test/src/test/resources/lib/form/ComboBoxTest/CompoundField/config.jelly
* test/src/test/resources/lib/form/ComboBoxTest/CompoundFieldComboBoxBuilder/config.jelly
  New test to confirm null is not passed for relative dependent arguments

Traditionally, matrix axis values are only exposed as "build variables", and it was up to individual build steps and others to treat them equally like environment variables.

However, in practice, this distinction between environment variables vs build variables didn't serve any useful purposes, and the down side (of some plugins only expanding env vars in the ${VAR} notation and not build variables) was probably bigger than whatever benefit this distinction was supposed to bring.

In this fix, we are exposing matrix axis values also as environment variables. This will make them recognizable from plugins that only expand environment variables, such as parameterized trigger plugins as indicated in the original bug report.

This was motivated by pull request #701 but fix was made differently.

This change is safe because (i) those actions are read-only and (ii) if they produce data that's bit old, that isn't really noticeable.

The Actionable#getActions() method only needs to be synchronized when lazy loading. After that, the synchronization is superfluous and impacts performance.
Since the field is volatile, the double-check block works in JDK5+. See http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html for more in
Analyzing various thread dumps, many threads and requests stall on this method waiting for the lock. Since the lock isn't necessary in most cases anyway,

Fixed to pass basic auth to HTTP connections when included in user info portion of URL (e.g. as API token).

- Environment variables are by convention upper case, so I'm switching to upper case. This was what the original ticket requested anyway.
- Since the ".jobName" was never documented to begin with, let's not promote that and stick to "_JOBNAME" as the official version.

added missing translations (save), adjusted an entry to match existing occurrences
corrected missing backslash escapes
deleted dislocated russian property file

removed some translations from GlobalSecurityConfiguration and jenkins/model/Jenkins
that should only exist in MasterComputer, DumbSlave & MasterBuildConfiguration

Introduced ${ITEM_FULL_NAME} to address the ticket without causing the
backward compatibility problem.

This is done by introducing a new base type 'BuildDiscarder' that's
extensible. Plugins can implement their own logics.

[JENKINS-16815] Specify ID and version in UpdateSite.updateDirectly

This fixes two annotation-indexers from different groupIds to get
bundled.

This reverts commit e2168722.

- Use the proper block cipher mode.
  Or else the information about the plain text still ends up revealing as a pattern without the attacker knowing the key.
- No need to hide SLAVE_SECRET from the encrypted payload.
  jnlpMac is needed to decrypt this payload to begin with, so there's no point in hiding it. This simplifies the code a little bit.
- Using a newer slave installer that uses the -secret option

Jesse's original patch

This came from pull request #705

Fixed the HTTP request thread saturation problem with Winstone.

eval("") is no-op in IE but window.execScript("") isn't.
So bring the uniformity outside

Failure to load JNA should be handled graciously

[FIXED JENKINS-16776] surefire-reports not detected for android-maven-plugin