This is broken since 2.128 there was an upgrade to winstone and thus jetty to version 9.4.8 but jetty changed the loading to use a service loader mechanism provided by the classpath. Since jenkins default installation is using the -jar command there is no way to pass the Service jar files to the command line of jenkins. -jar command line ignores any other jars provided using -classpath. Additionally these can't be passed using -Xbootclasspath either they throw a ClassNotFoundException for the jetty.ssl classes.
Trying to use conscrypt is also a non starter due to the previous issue. There is a possibility winstone can use the common URLClassLoader for loading the server classes but that is not what is happening. winstone initializes the Common ClassLoader before the listeners but doesn't do anything with it until after the listeners are started.
Please see JENKINS-52358 for more details