feat: restrict who is shown a buildAddUrl link, and enforce it on the redirect

[kurok]

Closes #41.

buildAddUrl(title: 'Deploy to PROD', url: '/job/deploy-prod/parambuild/?v=1.2.3',
            visibleTo: [users: ['alice'], groups: ['release-managers']])

Optional — listing nothing means no narrowing, and existing behaviour is unchanged.

Why not upstream's version

It returned null from getIconFileName() and stopped. That hides an icon, which is not access control: the target URL is in the page source, and on this fork the link is a Stapler-routed redirect whose path is derivable from the title and url.

So the check runs in all three places a link surfaces — the sidebar icon, the details-bar Detail, and doIndex, which now answers 404 instead of redirecting someone who was never meant to see it. The lgtm[jenkins/no-permission-check] justification on doIndex is gone, because it no longer applies.

Upstream also hand-rolled membership against User.getAuthorities() while ignoring the authorization strategy — which hid the link from an administrator who was not on the list. This only narrows what Jenkins has already granted; it cannot widen anything.

The tests fail without the enforcement, one per surface

aRestrictedLinkIsHiddenAndRefusedForEveryoneElse
  no sidebar icon ==> expected: <null> but was: </plugin/deploy-dashboard/deploy.png>
aGroupGrantsVisibility
  expected: <404> but was: <302>

That 302 is upstream's design failing exactly as described — hidden in the UI, served on request.

A bug the round-trip test caught

The step had no config.jelly at all, so the freestyle form and the Snippet Generator both rendered an empty panel. Adding one exposed this:

theFreestyleFormRoundTripsVisibleTo
  expected: <[alice]> but was: <[[alice]]>

A textarea submits one string, and binding that onto a List<String> stores the list's own toString() as a single element. The form rendered perfectly while quietly corrupting what was typed into it. It binds through text properties now. I would not have found this without writing the round trip, and a form that discards input is worse than no form.

Scope, stated in the README

visibleTo is not the security boundary for deploying. The job the link points at enforces its own permissions — a parambuild URL still requires Item.BUILD there. This decides who is shown a shortcut, and the README says so where someone configuring it will read it.

Local mvn clean verify: 44 tests, green.