Change "invalid subtype" (security check) from BeanDeserializerFactory into ClassNameIdResolver

[cowtowncoder]

Jackson 2.x intercepts attempts at deserializing certain "serialization gadget" classes with BeanDeserializerFactory, when locating deserializer. While this works, it happens at a point during which Class itself has already been resolved (from class name to Class object).
I am not 100% sure if this does trigger static initialization blocks, but if it does, then there is a potential concern still in allowing that to proceed.
And regardless of this aspect it seems better to catch the problem earlier, at least to the degree this is possible (some checks do require checking of inheritance hierarchy).

So: it would make sense to handle at least some of "serialization gadget" checks within ClassNameIdResolver, even if more checks were needed at a later point.