Update script-security plugin dependency to the latest version to fix security issues

[angry-cellophane]

Updating script security plugin to the latest version to address some security issues such as:

• https://snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-535484
• https://snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-471339
• https://snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-456244
• https://snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-456243
• https://snyk.io/vuln/SNYK-JAVA-ORGJENKINSCIPLUGINS-449971

and some more.

[oleg-nenashev]

It does not really change anything, because plugins are managed on the Jenkins level, and we expect it to be updated there. This version basically defines the minimum required version of the plugin. I do not see any harm in updating it, so approving it

[jglick]

Yeah makes no actual difference. Better to use https://github.com/jenkinsci/bom in general, though in this case there is just one dep so it hardly matters.

[oleg-nenashev]

I will merge it anyway, we expect users to use recent versions, so it makes sense to at least run tests with it

[angry-cellophane]

Thank you for quick response. I completely agree with everything you said.

The reason for me to raise this PR was slightly different and "enterprise-ish".
I work in an organization which cares about security probably more than on average. So in order to use this plugin I need to get it uploaded to an internal maven repo, and get the plugin scanned for vulnerabilities before. Even though I can use a newer version of script-sandbox (and I should) in jenkins, scan reports show security vulnerabilities in dependencies that makes my life harder as I need to explain why these vulnerabilities are not relevant for this plugin and it can be used internally. It's much easier to get it in the firm if the plugin has no known issues.

I'm not trying to start a discussion about best ways to scan libraries, and different ways to configure maven/gradle and java classpath, just wanted to share what was the reason behind this PR.

Appreciate your help and quick response.

[jglick]

scan reports show security vulnerabilities in dependencies

Try to configure your scanner to only show vulnerabilities in bundled dependencies, i.e., those physically present in the artifact—which this is not.