anchor.diff:  === Persist a reference to a specific credential instance
   
   You should be using `StandardCredentials` (or a more specific sub-interface) to access the Credentials API.
  -Persist the `StandardCredentials.getId()` of a credentials.
  -For any given context and authentication, the `StandardCredentials.getId()` should consistently return the same credentials instance.
  +Persist the `IdCredentials.getId()` of a credentials.
  +For any given context and authentication, the `IdCredentials.getId()` should consistently return the same credentials instance.
   
   [TIP]
   ====
  -Do not make any assumptions about the format of a `StandardCredentials.getId()` other than it must not contain `${...}`
  +Do not make any assumptions about the format of a `IdCredentials.getId()` other than it must not contain `${...}`
   ====
   
   .Historical evolution of the API
  
positive.code: )
  ----
  <1> There are different credential types that can be used to authenticate with the issue tracker, e.g. application tokens, OAuth authentication, user/password, etc.
  The only common feature is that we need each credential to have a StandardCredentials.getId()` to allow retrieval when building the job.
  <2> We need to limit the credentials to those types that we can actually use to authenticate with the issue tracker.
  We leverage the https://wiki.jenkins.io/display/JENKINS/Authentication+Tokens+API+Plugin[Authentication Tokens API] to convert the Jenkins credentials types into the issue tracker API's native authentication types.
  This means that we can use the `AuthenticationTokens.matcher(Class)` to restrict the list of credentials to the subset that can be converted.
  
  * We want to let the user select the credentials to toggle the deployment state of a blue/green deployment for a completed build.
  +
  
negative.code:   </f:entry>
  </j:jelly>
  ----
  +
  [NOTE]
  ====
  The `expressionAllowed` option only makes sense for configuring credentials that will be used in the context of a `hudson.model.Run` (technically it must be a `Run` of a `ParameterizedJob`).
  ====
  
  * In the case where the credentials will be used immediately in the context of the user selecting the credentials (as opposed to deferred usage in the context of a queued build job), you may want to allow credentials from the user's per-user credentials store:
  +
  