Apply the deserialization filter in test helpers on Java 9+

The `SerialUtil` test helper returned a plain, unfiltered
`ObjectInputStream` on Java 9 and later, so the deserialization
allowlist was only ever exercised by tests running on a Java 8
toolchain. It now installs `DefaultObjectInputFilter` (reflectively,
since the class must still compile and run on Java 8), combined with an
`ObjectInputFilter.Config.createFilter` delegate built from the
caller-supplied extra allowed classes, reproducing the
`FilteredObjectInputStream` semantics on modern JDKs. When
`DefaultObjectInputFilter` is absent (it only exists in the packaged
multi-release JAR), the helper falls back to
`FilteredObjectInputStream` on any Java version.

`SerializationTestHelper` in `log4j-1.2-api` now delegates to
`SerialUtil`, so its `org.apache.log4j.*` extras are honored on all
Java versions as well.

Part of the hardening series from #4168.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>