CVE-2026-41862: Kryo deserialization of persisted context without class allowlist

A high-severity CVE (CVE-2026-41862) has been disclosed in Spring Statemachine affecting versions 4.0.0–4.0.1 and 3.2.0–3.2.4. The Kryo-based persistence backends (JPA, MongoDB, Redis, ZooKeeper) deserialize persisted state-machine contexts without enforcing a class allowlist (CWE-502), enabling remote code execution in the application JVM. The fix enables Kryo.setRegistrationRequired(true) and introduces a KryoStateMachineSerialisationDefaults helper with an explicit allowlist. This is a breaking change: application-specific state and event types must now be explicitly registered with Kryo via a new Consumer<Kryo> callback, and pre-upgrade persisted contexts are wire-format incompatible with fixed versions. Redis users also face a key namespace change that makes existing keys invisible after upgrade.