Restore script-security updates (#2817)

* Restore `script-security` updates

* Clearer expansion of `PCT_OPTS`

.github/dependabot.yml

@@ -9,8 +9,6 @@ updates:
     open-pull-requests-limit: 25
     directory: "/bom-weekly"
     ignore:
-      - dependency-name: "org.jenkins-ci.plugins:script-security"
-        versions: ["1310.vf24a_dfce068b_"]
       - dependency-name: "io.jenkins.plugins:custom-folder-icon"
         versions: ["2.11"]
     schedule:

README.md

@@ -191,6 +191,15 @@ DOCKERIZED=true
 
 to reproduce image-specific failures.
 
+You can also pass
+
+```sh
+PCT_OPTS=--local-checkout-dir=/path/to/plugin
+```
+
+to check a local patch without waiting for incrementals deployment,
+if you have switched the version in `bom-weekly/pom.xml` to a `*-SNAPSHOT`.
+
 To minimize cloud resources, PCT is not run at all by default on pull requests, only some basic sanity checks.
 Add the label `full-test` to run PCT in a PR.
 If you lack triage permission and so cannot add this label, then you may instead

bom-weekly/pom.xml

@@ -879,7 +879,7 @@
       <dependency>
         <groupId>org.jenkins-ci.plugins</groupId>
         <artifactId>script-security</artifactId>
-        <version>1305.v487433146192</version>
+        <version>1313.v7a_6067dc7087</version>
       </dependency>
       <dependency>
         <groupId>org.jenkins-ci.plugins</groupId>

pct.sh

@@ -27,6 +27,7 @@ exec java \
 	--include-plugins "${PLUGINS}" \
 	--working-dir "$(pwd)/target/pct-work" \
 	$PCT_D_ARGS \
+	${PCT_OPTS-} \
 	-Djth.jenkins-war.path="$(pwd)/target/megawar-$LINE.war" \
 	-Dsurefire.excludesFile="$(pwd)/excludes.txt"