Serialize ObjectArrayMessage elements through the filtered wrapper

`ObjectArrayMessage.readObject` read its `Object[]` with a plain
`readObject()` call, the last remaining direct object read in a
shipped `readObject` method. It now uses the same per-element
`writeWrappedObject`/`readWrappedObject` mechanism as
`ParameterizedMessage`, which re-applies the deserialization allowlist
to each element and replaces non-`Serializable` elements with their
`String.valueOf` representation on the writing side.

The shared loop moves to `SerializationUtil.writeWrappedObjects`/
`readWrappedObjects`, which also bounds the array allocation during
deserialization: at most 256 elements are pre-allocated and the array
grows as elements are actually read, so a forged length cannot force a
large allocation. `ParameterizedMessage`, whose serialized form is
unchanged, picks up the same bound on its previously eager
`new Object[argCount]`.

Compatibility: the serialized form of `ObjectArrayMessage` changes;
streams written by earlier versions are rejected by newer readers and
vice versa.

Part of the hardening series from #4168.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>