Add CredentialsUseListener to improve tracking of Credentials usage

[meiswjn]

This change will allow tracking Credentials usage much easier, independent from Fingerprints. So far it was necessary to use the SaveableListener provided by the Fingerprints to subscribe to Credentials usage. Because certain credential consumers do not create fingerprints, this approach is flawed.

Creating the listener gives a lightweight method of tracking Credentials usage, improving overall security.

Tests are not provided, as the logic of the abstract functions is to be implemented by plugins using this approach. Tests are included in the plugin mentioned below.

Usecase: jenkinsci/audit-trail-plugin#68

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[jglick]

Is there a downstream PR in some plugin showing what this would be used for?

[meiswjn]

Thanks for your review, @jglick! I implemented all suggestions.

Is there a downstream PR in some plugin showing what this would be used for?

I am trying to track all objects that access credentials in an audit log (See downstream PR jenkinsci/audit-trail-plugin#68).

This works well for most cases, but not all. For example, the GitHub Branch Source plugin accesses credentials via CredentialMatchers as seen in the class GitHubSCMBuilder. If anyone has an idea how to track that kind of access, please let me know.

[jglick]

how to track that kind of access

Best to move track calls upstream into this plugin where possible. Recheck behavior after jenkinsci/github-branch-source-plugin#527, and see my comment in #293 (this PR would be a reasonable place to fix up any missing tracking).

[jglick]

Looks fine to me. Did you successfully use this API revision in the downstream PR?

[meiswjn]

Yes, the new API revision works perfectly.

[jglick]

If all goes well, a new release should appear shortly.