[BACKPORT 3.10.x] Add basic protection against untrusted deserialization.

[kwart]

Backport of #12230 to 3.10.x.

The configuration of the backported feature doesn't depend on XSD changes, but it is based on following Hazelcast group properties:

Property name	Description	Default value
hazelcast.serialization.filter.enabled	Enables Java deserialization protection - filtering based on blacklist and whitelist.	false
hazelcast.serialization.filter.blacklist.classes	Comma separated list of blacklisted class names in Java deserialization protection feature	"" (empty)
hazelcast.serialization.filter.blacklist.packages	Comma separated list of blacklisted package names in Java deserialization protection feature	"" (empty)
hazelcast.serialization.filter.whitelist.classes	Comma separated list of whitelisted class names in Java deserialization protection feature	"" (empty)
hazelcast.serialization.filter.whitelist.packages	Comma separated list of whitelisted package names in Java deserialization protection feature	"" (empty)

If both *.blacklist.classes and *.blacklist.packages properties are empty and deserialization protection is enabled, then a hardcoded list of well known vulnerable classes and packages is used.