KAFKA-20822: Harden Trogdor polymorphic JSON deserialization

[lh0156]

Fixes KAFKA-20822.

Summary

• Configure Trogdor's shared Jackson mapper with a BasicPolymorphicTypeValidator.
• Allow only built-in TaskSpec implementations from the task, fault, and workload packages.
• Add regression coverage proving unsupported TaskSpec subtypes are rejected while built-in types from each supported package remain readable.

Why

TaskSpec uses Jackson JsonTypeInfo.Id.CLASS, which previously allowed any class on the classpath that extended TaskSpec to be selected by the incoming class type id. The allowlist preserves the existing wire format and built-in task types while preventing external subtypes from being instantiated.

Verification

• TDD RED: the unsupported-subtype regression test instantiated the external test subtype before the validator was added.
• TDD GREEN: ./gradlew :trogdor:test --tests org.apache.kafka.trogdor.task.TaskSpecTest --no-build-cache
• Full module tests: ./gradlew :trogdor:test --no-build-cache
• Static checks: ./gradlew :trogdor:spotlessCheck :trogdor:checkstyleMain :trogdor:checkstyleTest :trogdor:spotbugsMain --no-build-cache
• git diff --check

No public JSON shape or built-in Trogdor task behavior is changed.

[lh0156]

Rebased this PR onto the latest trunk and added the Kafka-required AI contribution trailer to the commit (Generated-by: OpenAI Codex (GPT-5)).

Independent verification on the rebased commit:

• ./gradlew :trogdor:test :trogdor:spotlessCheck :trogdor:checkstyleMain :trogdor:checkstyleTest :trogdor:spotbugsMain --no-build-cache --console=plain
• All Trogdor tests passed, including the built-in TaskSpec allowlist and external-subtype rejection coverage.