[JENKINS:SECURITY-3016] Sandbox bypass vulnerability in `script-security`

script-security provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute.
Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

In script-security 1228.vd93135a_2fb_25 and earlier, property assignments performed implicitly by the Groovy language runtime when invoking map constructors were not intercepted by the sandbox.

This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

script-security 1229.v4880b_b_e905a_6 intercepts property assignments when invoking map constructors.

NOTE: As part of this fix, map constructors may only be invoked in the sandbox using the new keyword. Attempting to invoke a map constructor using a Groovy cast will fail unconditionally. For example, code such as [key: value] as MyClass or MyClass mc = [key: value] must be converted to use new MyClass(key: value) instead.