Remove the default serializable packages and deprecated the property to introduce org.apache.avro.SERIALIZABLE_CLASSES instead

[jbonofre]

As discussed within the Parquet community, this PR is more "restrictive":

1. no serializable packages by default
2. deprecate org.apache.avro.SERIALIZABLE_PACKAGES property
3. instead of SERIALIZABLE_PACKAGES, users should use org.apache.avro.SERIALIZABLE_CLASSES

This is a much more "strict" security enforcement.

[jbonofre]

@gszadovszky @Fokko @martin-g ^^

[jbonofre]

@nandorKollar @martin-g @Fokko I updated the PR. Can you please do a new pass ?

[nandorKollar]

Overall LGTM! Thanks for fixing this!

[jbonofre]

@martin-g @Fokko @nandorKollar I'm volunteer to do new Avro releases (1.11.5 and 1.12.1) including this. Thoughts ?

[nandorKollar]

@martin-g @Fokko @nandorKollar I'm volunteer to do new Avro releases (1.11.5 and 1.12.1) including this. Thoughts ?

I'll wait a couple of more days for any objection, then I'll merge this PR. Would be great if you could help with the release!

[Fokko]

Thanks for waiting @nandorKollar, my mailbox is overflowing. This looks good to me, thanks @jbonofre for working on this 👍

[Fokko]

@jbonofre I'm seeing some errors on main: https://github.com/apache/avro/actions/runs/15121164134/job/42503656318

Error:  Errors: 
Error:    TestReflect.nullableStringableField:1179->checkBinary:1206->checkBinary:1184->checkBinary:1200 » Security Forbidden java.math.BigDecimal! This class is not trusted to be included in Avro schema using java-class. Please set org.apache.avro.SERIALIZABLE_CLASSES system property with the class you trust or org.apache.avro.SERIALIZABLE_PACKAGES system property with the packages you trust.
Error:    TestReflect.r10:434->checkReadWrite:623 » Security Forbidden org.apache.avro.reflect.TestReflect$R10! This class is not trusted to be included in Avro schema using java-class. Please set org.apache.avro.SERIALIZABLE_CLASSES system property with the class you trust or org.apache.avro.SERIALIZABLE_PACKAGES system property with the packages you trust.
Error:    TestReflect.stringableMapKeys:1166->checkBinary:1184->checkBinary:1200 » Security Forbidden java.math.BigDecimal! This class is not trusted to be included in Avro schema using java-class. Please set org.apache.avro.SERIALIZABLE_CLASSES system property with the class you trust or org.apache.avro.SERIALIZABLE_PACKAGES system property with the packages you trust.
Error:    TestReflect.stringables:1126->checkStringable:1138->checkBinary:1206->checkBinary:1184->checkBinary:1200 » Security Forbidden java.math.BigDecimal! This class is not trusted to be included in Avro schema using java-class. Please set org.apache.avro.SERIALIZABLE_CLASSES system property with the class you trust or org.apache.avro.SERIALIZABLE_PACKAGES system property with the packages you trust.

[nandorKollar]

Ooops, looks like setting org.apache.avro.SERIALIZABLE_CLASSES is missing from lang/java/avro/src/it/pom.xml

[jbonofre]

@nandorKollar @Fokko i was a out to fix the IT as we are now much more restrictive than before. Thanks @nandorKollar for fixing that in the other PR !