Issue #387 Add deprecated jsp rule key

[gtoison]

Between version 3.3 and 3.4 of the plugin rules XSS_JSP_PRINT and XSS_REQUEST_PARAMETER_TO_JSP_WRITER have been moved from the Java findsecbugs repository to the JSP findsecbugs-jsp repository.

When a rule key is modified the plugin should apparently declare it's "deprecated key(s)" to let SonarQube know, see: https://javadocs.sonarsource.org/7.1/apidocs/org/sonar/api/server/rule/RulesDefinition.Rule.html#deprecatedRuleKeys--

The database was left in an apparently inconsistent state for SQ installations where the plugin had been upgraded from <= 3.3 to >= 3.4
Then when the API used to load profiles was changed in #369 (to make the plugin compatible with SQ 9) the server crashed on startup with error: BadRequestException: java rule findsecbugs:XSS_JSP_PRINT cannot be activated on jsp profile FindBugs Security JSP

This PR adds the "deprecated keys" (i.e. the old rules ID) for these two rules and prevent the plugin from trying to activate a removed rule into a profile.

[gtoison]

Hello @KengoTODA,
Could you please review this PR? There are several duplicated issues for it, so lots of users are affected (#387 #389 and #393).
The checks fail because I do not have the right to run a SQ analysis.
Please let me know if something is unclear or needs to be adjusted.

Pull request #386 is also ready for review when someone has time

[gtoison]

@pethers could you please review this PR?
It solves the most pressing issue: the plugin causes the entire SQ server to crash at startup on installations that had version 3.3 or earlier and upgraded progressively to the current version

[pethers]

Not sure why https://github.com/spotbugs/sonar-findbugs/runs/3948483294?check_suite_focus=true is failing but will review the code changes.

[pethers]

looks good to me.

[gtoison]

Thanks @pethers
If I understand correctly the action is running on my forked repo, and that repo does not have the permission to run the SonarQube analysis

@KengoTODA, is there a suggested workflow before merging PRs? Like getting two reviews, waiting a bit for potential comments, etc?

I looked at some old outstanding PR and if I hypothetically wanted to merge them I do not seem to have the rigths: