OAuth2ClientJacksonModule is missing allowIfSubType for URL and Instant

Describe the bug
setup a spring mvc app with oauth2Login and redis session. When trying to login with any OIDC / OAuth 2 provider, after redirecting back to the app, it throws an error.

org.springframework.data.redis.serializer.SerializationException: Could not read JSON: Could not resolve type id 'java.net.URL' as a subtype of java.lang.Object: Configured PolymorphicTypeValidator (of type tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator) denied resolution
at [Source: REDACTED (StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION disabled); byte offset: #1982] (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken["principal"]->org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser["authorities"]->java.util.HashSet[0]->org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority["idToken"]->org.springframework.security.oauth2.core.oidc.OidcIdToken["claims"]->java.util.LinkedHashMap["iss"])
at org.springframework.data.redis.serializer.JacksonJsonRedisSerializer.deserialize(JacksonJsonRedisSerializer.java:143)

org.springframework.data.redis.serializer.SerializationException: Could not read JSON: Could not resolve type id 'java.time.Instant' as a subtype of java.lang.Object: Configured PolymorphicTypeValidator (of type tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator) denied resolution
at [Source: REDACTED (StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION disabled); byte offset: #2435] (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken["principal"]->org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser["authorities"]->java.util.HashSet[0]->org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority["idToken"]->org.springframework.security.oauth2.core.oidc.OidcIdToken["claims"]->java.util.LinkedHashMap["exp"])
at org.springframework.data.redis.serializer.JacksonJsonRedisSerializer.deserialize(JacksonJsonRedisSerializer.java:143)

Locate OAuth2ClientJacksonModule and inspect how subtype permissions are configured for claims. Reproduce the OAuth2/OIDC login with Redis-backed sessions, then verify that serialized URL and Instant claims can be deserialized without the PolymorphicTypeValidator errors shown in the report.