fix: remediate insecure object deserialization in BlobUtils [ACT-2842]

[ethan ozelius (ethan-ozelius-contentful)]

Summary

• Root cause: BlobUtils.fromBlob used ObjectInputStream.readObject() without restricting which classes could be deserialized, enabling gadget-chain RCE if an attacker could influence blob
  data (Wiz finding WS-I013-JAVA-00051, HIGH)
• Fix: Override resolveClass with an allowlist of permitted types (HashMap, LinkedHashMap, ArrayList, and standard primitives) — any unexpected class throws InvalidClassException before
  instantiation
• Defense-in-depth: Added validateBlobInput to reject null, empty, oversized (>1MB), and malformed (non-0xACED header) blobs before ObjectInputStream is ever opened
• Tests: Added BlobUtilsTest covering round-trip happy paths, malicious class rejection, and all four input validation guards