[FIXED SECURITY-93] PasswordParameterDefinition should serve existing default value in encrypted form.

And strengthen functional tests (using configRoundTrip) to ensure that the same mistake is not made elsewhere.

core/src/main/java/hudson/Functions.java

@@ -1464,6 +1464,9 @@ public class Functions {
     public String getPasswordValue(Object o) {
         if (o==null)    return null;
         if (o instanceof Secret)    return ((Secret)o).getEncryptedValue();
+        if (getIsUnitTest()) {
+            throw new SecurityException("attempted to render plaintext ‘" + o + "’ in password field; use a getter of type Secret instead");
+        }
         return o.toString();
     }