fix: resolve, check and parse manifests more carefully in the Jackson serializers (#3503)

[pjfanning]

cherry pick 67c3b55 #3503

Motivation:
Four issues in JacksonSerializer, all reachable from a wire manifest:

• The case object branch called getObjectFor before checkAllowedClass. getObjectFor reads the MODULE$ field, which initializes the class, so a manifest naming a class the allow list would reject ran that class's initializer on the way to being rejected.
• LZ4Meta.get checked for 4 remaining bytes and then read 8, so a 4 to 7 byte payload beginning with the LZ4 magic raised BufferUnderflowException.
• parseManifest called toInt on whatever followed the last '#', so a non-numeric version raised NumberFormatException.
• isInAllowList evaluated isBoundToJacksonSerializer first, which calls serializerFor and raises (filling in a stack trace) for a class that is allowed only by prefix. checkAllowedClass runs on every fromBinary.

Modification:
Resolve the case object's class with getClassFor, which does not initialize, run checkAllowedClass on it, and only then read the module field. Require 8 remaining bytes for an LZ4 header. Parse the manifest version with toIntOption and report a bad one as NotSerializableException. Test the prefix before the binding, which cannot throw. Applied to both serialization-jackson and serialization-jackson3.

Result:
A rejected manifest no longer initializes the class it names, two malformed manifests are reported as serialization failures rather than as unrelated runtime exceptions, and the allow list check no longer builds an exception per message on the prefix path. No change for manifests that were accepted before.