Change "invalid subtype" (security check) from `BeanDeserializerFactory` into `ClassNameIdResolver`

Jackson 2.x intercepts attempts at deserializing certain "serialization gadget" classes with `BeanDeserializerFactory`, when locating deserializer. While this works, it happens at a point during which `Class` itself has already been resolved (from class name to `Class` object).
I am not 100% sure if this does trigger static initialization blocks, but if it does, then there is a potential concern still in allowing that to proceed.
And regardless of this aspect it seems better to catch the problem earlier, at least to the degree this is possible (some checks do require checking of inheritance hierarchy).

So: it would make sense to handle at least some of "serialization gadget" checks within `ClassNameIdResolver`, even if more checks were needed at a later point.