JENKINS-74820 - forceSandBox - Hide command-launcher drop down from non-administrators

[jgarciacloudbees]

JENKINS-74820 - forceSandBox - Hide command-launcher drop down from non-administrators

---

Breaking changes:
This relies on jenkinsci/jenkins#9495 for managing error messages when saving Command-Launcher in non allowed cases (nonAdmin users saving an existing node with Launcher = commandLauncher when forceSandbox is enabled)

In order to do so, we have modified from:

@DataBoundConstructor
    public CommandLauncher(String command) {

To

@DataBoundConstructor
    public CommandLauncher(String command) throws Descriptor.FormException {

So in order to use it we need to modify the implementations using the "constructor CommandLauncher(String command)" to proper handle the exception "Descriptor.FormException"

---

Related to jenkinsci/script-security-plugin#585

Related to JENKINS-73941 - Option to hide "Use Groovy Sandbox" for users without Administer permission globally in the system.

When creating new nodes in the system based on the Launch Method "Launch agent via execution of command on the controller", the plugin Command-Launcher-Plugin does not support the Sandbox execution, so is automatically creating new scripts to be verified by the admin.

In the context of the forceSandbox changes implemented in JENKINS-73941, this is not allowed, so we should hide this option in this case.

We have implemented a new DescriptorVisibilityFilter to verify this case of use:

• hudson.slaves.CommandLauncher.DescriptorVisibilityFilterForceSandBox

Tests Implemented:

• New class hudson.slaves.CommandLauncherForceSandboxTest

This covers all the scenarios:

• In case a new node is created, the user is non admin and forceSandbox is enabled, CommandLauncher Descriptor is not offered.
• In any other creation scenario, CommandLauncher Descriptor is offered.
  *When editing a node, if the user is non admin and forceSandbox is enabled, the CommandLauncher Descriptor is not offered, except if the existing node already has this Launcher configured
• In this case, if the nonAdmin user tries to save the Node definition with the launcher "CommandLauncher" it will fail with Descriptor.FormException. In case the user changes the descripfor to any other one, then he will be able to save it.

Manual tests:

• When launching a node with CommandLauncher configured and forceSandbox enabled in the system, if the script is not approved, in the launch message, we don't see any reference to admin approval, but just informing the system requires the sandbox enabled.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

CC: @jglick, @amuniz.