Add allowIfSubType for URL and Instant in OAuth2ClientJacksonModule

[qwerty7878]

Fixes gh-19241

Problem

OAuth2ClientJacksonModule was missing allowIfSubType entries for java.net.URL and java.time.Instant, causing a SerializationException when deserializing OAuth2 authentication tokens stored in Redis session. The error occurs because OidcIdToken claims contain iss as a URL and iat/exp as Instant, which the PolymorphicTypeValidator denied.

Fix

Added allowIfSubType(URL.class) and allowIfSubType(Instant.class) to configurePolymorphicTypeValidator in OAuth2ClientJacksonModule.

Tests

• deserializeWhenClaimsContainUrlAndInstantThenDeserializes — verifies that OAuth2AuthenticationToken containing URL and Instant claim types can be serialized and deserialized successfully