Update detached plugins to reflect security releases (#2817)

* [SECURITY-372] Update bundled mailer to 1.20.

* Updated to pick up other detached plugins mentioned in https://jenkins.io/security/advisory/2016-04-11/ or https://jenkins.io/security/advisory/2017-03-20/ while we are here.

* I18nTest.test_baseName_plugin caught that the detached version of credentials was too old to serve as a dependency.
Probably there should be some test case verifying that all detached plugins could be loaded at once,
though it would need to do a topological sort in dependency order.

* Must also include display-url-api as a detached plugin as it is a dependency, even though it was never actually detached from core.

* @oleg-nenashev insists on bundling display-url-api 2.0.

core/src/main/java/hudson/PluginManager.java

@@ -727,6 +727,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
             InstallUtil.saveLastExecVersion();
         } else {
             final Set<ClassicPluginStrategy.DetachedPlugin> forceUpgrade = new HashSet<>();
+            // TODO using getDetachedPlugins here seems wrong; should be forcing an upgrade when the installed version is older than that in WEB-INF/detached-plugins/
             for (ClassicPluginStrategy.DetachedPlugin p : ClassicPluginStrategy.getDetachedPlugins()) {
                 VersionNumber installedVersion = getPluginVersion(rootDir, p.getShortName());
                 VersionNumber requiredVersion = p.getRequiredVersion();