[backport camel-4.18.x] CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms

[oscerd]

Backport of #22598

Cherry-pick of #22598 onto camel-4.18.x.

Original PR: #22598 - CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms
Original author: @oscerd
Target branch: camel-4.18.x
Jira: https://issues.apache.org/jira/browse/CAMEL-23321

Two commits cherry-picked in order:

1. CAMEL-23321: Add deserialization filtering for JMS ObjectMessage handling in camel-jms and camel-sjms
2. Regen

Conflict resolution

One minor, style-only conflict in components/camel-sjms/src/main/java/org/apache/camel/component/sjms/jms/JmsBinding.java. main had been refactored to use pattern-matching instanceof (payload instanceof DefaultExchangeHolder holder); camel-4.18.x still uses the explicit-cast style. Resolved by keeping the existing 4.18.x style and adding only the security-relevant change:

Object payload = objectMessage.getObject();
checkDeserializedClass(payload);                         // added
if (payload instanceof DefaultExchangeHolder) {
    DefaultExchangeHolder holder = (DefaultExchangeHolder) payload;
    DefaultExchangeHolder.unmarshal(exchange, holder);   // NOSONAR
    return exchange.getIn().getBody();
}

All other code (the checkDeserializedClass method itself, the new deserializationFilter option on JmsConfiguration / SjmsEndpoint, generated descriptors, DSL factories) was auto-merged cleanly.

Verification

• Cherry-pick applied successfully (one conflict, resolved as described above)
• camel-jms and camel-sjms compile cleanly on the camel-4.18.x baseline
• Apache CI will run the authoritative test suite

Claude Code on behalf of Andrea Cosentino