Add findsecbugs plugin to spotbugs.

And suppress existing warnings. We should clean some of them up, but that's for different PRs.

core/src/main/java/hudson/ClassicPluginStrategy.java

@@ -78,6 +78,7 @@ import java.util.logging.Logger;
 
 import static org.apache.commons.io.FilenameUtils.getBaseName;
 
+@SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "Admistrator action installing a plugin, which could do far worse.")
 public class ClassicPluginStrategy implements PluginStrategy {
 
     private static final Logger LOGGER = Logger.getLogger(ClassicPluginStrategy.class.getName());