Add Jackson PolymorphicTypeValidator #1297

This Jackson usage is very dangerous. It means that Jackson will load any class that appears in the JSON. There is a disallow list for well-known gadgets but it is highly recommended to a PolymorphicTypeValidator to your ObjectMapper to lock down which classes can be loaded.
https://github.com/search?q=repo%3Aapache%2Fcurator%20Id.CLASS&type=code

Example
https://github.com/apache/drill/pull/3057/changes#diff-e55fd14c5d3a9a463736a342682c0f7d3644d1e47ba6700c1fce001a493deda1R69