update to groovy 2.4.21

[car-roll]

See JENKINS-65237.
Investigating the effort it will take to upgrade to groovy 2.4.21

Proposed changelog entries

• Entry 1: Issue, Human-readable Text
• ...

Proposed upgrade guidelines

N/A

Submitter checklist

• (If applicable) Jira issue is well described
• Changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developer, depending on the change). Examples
  • Fill-in the Proposed changelog entries section only if there are breaking changes or other changes which may require extra steps from users during the upgrade
• Appropriate autotests or explanation to why this change has no tests
• For dependency updates: links to external changelogs and, if possible, full diffs

Desired reviewers

@mention

Maintainer checklist

Before the changes are marked as ready-for-merge:

• There are at least 2 approvals for the pull request and no outstanding requests for change
• Conversations in the pull request are over OR it is explicit that a reviewer does not block the change
• Changelog entries in the PR title and/or Proposed changelog entries are correct
• Proper changelog labels are set so that the changelog can be generated automatically
• If the change needs additional upgrade steps from users, upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the PR title. (example)
• If it would make sense to backport the change to LTS, a Jira issue must exist, be a Bug or Improvement, and be labeled as lts-candidate to be considered (see query).

[daniel-beck]

Previously: #5116

[jglick]

What is the purpose of this PR? Just to get incremental builds for downstream tests, like jenkinsci/bom#389?

[car-roll]

@jglick yes, I was planning on using it for downstream tests.

[ronniezhou]

Hi @car-roll is this still something you are working on or would like to work on soon? We found this also addresses https://groovy-lang.org/security.html#CVE-2020-17521 which is needed by some customer.

[car-roll]

HI @ronniezhou , I had been planning to work on this, but my priorities have been shifted around so this has been put on hold at the moment.

[timja]

@car-roll do you need to keep this open? bom testing passed in jenkinsci/bom#449

[car-roll]

@timja no, will close now as my priorities have been shifted around. Thanks for the reminder.