Apply the deserialization filter in test helpers on Java 9+

[ppkarwasz]

Important

This PR is part of the deserialization hardening work tracked in #4168. The Logging Services PMC does not use nor recommend Java serialization/deserialization, and our security FAQ has long documented this position. This work is submitted solely to reduce the false-positive "vulnerability" reports that keep being filed regardless of that FAQ. Its utility for end users is close to zero.

The SerialUtil test helper returned a plain, unfiltered ObjectInputStream on Java 9 and later, so our test suite only exercised the deserialization allowlist when running on a Java 8 toolchain. This made it possible for a change to the serialized forms to pass CI while being rejected by the filter at runtime.

SerialUtil now installs DefaultObjectInputFilter on Java 9+ (reflectively, since the helper must still compile and run on Java 8), combined with an ObjectInputFilter.Config.createFilter delegate built from the caller-supplied extra allowed classes — reproducing FilteredObjectInputStream's semantics on modern JDKs. When DefaultObjectInputFilter is unavailable — it only exists in the packaged multi-release log4j-api jar, not in classes-dir reactor builds — the helper falls back to FilteredObjectInputStream, which enforces the same allowlist on any Java version.

SerializationTestHelper in log4j-1.2-api now delegates to SerialUtil, so its org.apache.log4j.* extras are honored on all Java versions as well.

Test-only change; no user-visible behavior is affected.

[ramanathan1504]

I checked the Java 9+ branch with a packaged log4j-api jar. Config.createFilter returns UNDECIDED for names it does not list, so the default allowlist still runs after it. java.io.File is rejected with no extras and allowed when passed as one. Arrays of it too.

Nothing tests it though. On 2.x today SerialUtil.getObjectInputStream returns a plain ObjectInputStream on JDK 17 and reads a java.io.File back fine. One assertThrows(IOException.class, ...) in log4j-api-test fails before this change and passes after, on Java 8 and Java 9+ both.