[JENKINS-37368] Improve performance in DownstreamPassCondition RunListener

[dwnusbaum]

Impersonate SYSTEM in DownstreamPassCondition's RunListener before calling getAllItems for faster ACL checks, and then verify the original authentication had read permission just before considering a build for promotion.

https://issues.jenkins-ci.org/browse/JENKINS-37368

@reviewbybees

[ghost]

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

[oleg-nenashev]

Formatting-free diff: https://github.com/jenkinsci/promoted-builds-plugin/pull/105/files?w=1

[dwnusbaum]

I realized that the test I added passes even if I don't reset the SecurityContext after impersonating SYSTEM, which made it useless. I've reverted that commit. I might have just been doing something wrong, so if there is a correct way to check that the SecurityContext is reset I can make a working test.

[jglick]

if there is a correct way to check that the SecurityContext is reset

You are clearly resetting it in a finally block so I think there is not much to test there.

If there is not already functional test coverage for the promotion condition as a whole, that would be useful to add, though IIRC this plugin has fairly extensive tests already; you can enable JaCoCo and check whether the edited code is covered, if you are nervous.

[dwnusbaum]

Good point about JaCoCo, the code is covered by an existing test that checks that a build gets promoted.

[recampbell]

@reviewbybees done

[oleg-nenashev]

🐝

[oleg-nenashev]

Merging & Releasing. Manually tested the patch, it seems to work fine