Cleanup SafeSerializationUtils to remove unused Guava classes

[cwperks]

Description

In SafeSerializationUtils, we previously allowlisted Guava classes when user attribute serialization was enabled but now switched to wrapping in HashMap. These classes are no longer required and can be safely removed.

Also adds ObjectInputFilter with maxdepth=10 to SafeObjectInputStream to limit deserialization depth.

Companion PR to opensearch-project/security#6152

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Maintenance

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Add array and reference limits The object input filter only restricts depth but doesn't limit array sizes or object graph sizes, which could still allow memory exhaustion attacks. Add additional constraints like maxarray and maxrefs to provide comprehensive protection against deserialization attacks. src/main/java/org/opensearch/commons/authuser/util/Base64Helper.java [83] -setObjectInputFilter(ObjectInputFilter.Config.createFilter("maxdepth=10")); +setObjectInputFilter(ObjectInputFilter.Config.createFilter("maxdepth=10;maxarray=1000;maxrefs=1000")); Suggestion importance[1-10]: 7 __ Why: This is a valid security enhancement that adds maxarray and maxrefs constraints to protect against memory exhaustion attacks during deserialization. The suggestion correctly identifies a gap in the current filter configuration and provides a reasonable solution.	Medium
General	Increase deserialization depth limit The maxdepth=10 filter may be insufficient for complex object graphs and could cause legitimate deserialization to fail. Consider increasing the depth limit or making it configurable based on actual usage patterns to prevent unexpected deserialization failures. src/main/java/org/opensearch/commons/authuser/util/Base64Helper.java [83] -setObjectInputFilter(ObjectInputFilter.Config.createFilter("maxdepth=10")); +setObjectInputFilter(ObjectInputFilter.Config.createFilter("maxdepth=20")); Suggestion importance[1-10]: 3 __ Why: While the suggestion correctly identifies the line where maxdepth=10 is set, it makes an assumption without evidence that this limit is insufficient. The choice of depth limit should be based on actual requirements rather than arbitrary increases.	Low