Implement ObjectInputFilter allowlist for legacy object deserialization

[AliRana30]

What changes?

1. ObjectFileSerialization:
   • Adds createObjectInputFilter(Class<?> elementType) to restrict legacy object deserialization to expected primitives, wrappers, standard safe collections, Wayang types, Scala tuples, and expected elementType hierarchies.
   • Adds dynamic allowlist pattern configuration via wayang.basic.serialization.allowlist.
   • Rejects unauthorized classes with InvalidClassException.
2. WayangValue:
   • Enforces the ObjectInputFilter on Flink criterion deserialization.
   • Refactors convertToByte and convertToObject to use try-with-resources.
3. Tests:
   • Added unit test cases to verify rejection of disallowed classes, explicit elementType acceptance, and system property pattern matching.

Why are the changes needed?

Directly calling ObjectInputStream.readObject() without an ObjectInputFilter allows arbitrary class instantiation, posing a deserialization security risk (CWE-502).

How was this tested?

• Unit tests added to ObjectFileSerializationTest and WayangValueTest.
• Ran mvn test on wayang-basic and wayang-flink.
• Ran mvn apache-rat:check.

Closes : #835

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[AliRana30]

@zkaoudi Pr is up for your review.