Maybe it works to call the Secret ctor on the controller side (the serial form is plaintext)

Author: jglick

Jenkinsfile

@@ -1,5 +1,5 @@
 buildPlugin(configurations: [
     [ platform: "linux", jdk: "8"],
     [ platform: "windows", jdk: "8"],
-    [ platform: "linux", jdk: "11"]
+    [ platform: "linux", jdk: "11", jenkins: "2.176.4", javaLevel: "8" ]
 ])

pom.xml

@@ -25,7 +25,7 @@
         <changelist>-SNAPSHOT</changelist>
         <hpi.compatibleSinceVersion>2.2.0</hpi.compatibleSinceVersion>
         <java.level>8</java.level>
-        <jenkins.version>2.235.1</jenkins.version>
+        <jenkins.version>2.176.4</jenkins.version>
         <useBeta>true</useBeta>
         <jjwt.version>0.11.2</jjwt.version>
     </properties>
@@ -114,7 +114,7 @@
         <dependencies>
             <dependency>
                 <groupId>io.jenkins.tools.bom</groupId>
-                <artifactId>bom-2.235.x</artifactId>
+                <artifactId>bom-2.176.x</artifactId>
                 <version>11</version>
                 <scope>import</scope>
                 <type>pom</type>

src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubAppCredentials.java

@@ -218,13 +218,13 @@ public String getUsername() {
         @Override
         public Secret getPassword() {
             try {
-                return Secret.fromString(ch.call(new GetPassword(data)));
+                return ch.call(new GetPassword(data));
             } catch (IOException | InterruptedException x) {
                 throw new RuntimeException(x);
             }
         }
 
-        private static final class GetPassword extends SlaveToMasterCallable<String, RuntimeException> {
+        private static final class GetPassword extends SlaveToMasterCallable<Secret, RuntimeException> {
 
             private final String data;
 
@@ -233,9 +233,9 @@ private static final class GetPassword extends SlaveToMasterCallable<String, Run
             }
 
             @Override
-            public String call() throws RuntimeException {
+            public Secret call() throws RuntimeException {
                 String[] fields = Secret.fromString(data).getPlainText().split(SEP);
-                return generateAppInstallationToken(fields[0], fields[1], fields[2], fields[3]);
+                return Secret.fromString(generateAppInstallationToken(fields[0], fields[1], fields[2], fields[3]));
             }
 
         }