Address PR feedback: remove security tag, add PR link, clarify comments

Co-authored-by: tvaron3 <70857381+tvaron3@users.noreply.github.com>

Author: Copilot

sdk/cosmos/azure-cosmos/CHANGELOG.md

@@ -9,7 +9,7 @@
 #### Bugs Fixed
 * Fixed an issue where `query plan` failed with `400` or query return empty result when `CosmosQueryRequestOptions` has partition key filter and  partition key value contains non-ascii character. See [PR 47881](https://github.com/Azure/azure-sdk-for-java/pull/47881)
 * Fixed an issue where operation failed with `400` when configured with pre-trigger or post-trigger with non-ascii character. Only impact for gateway mode. See [PR 47881](https://github.com/Azure/azure-sdk-for-java/pull/47881)
-* **[SECURITY]** Fixed Remote Code Execution (RCE) vulnerability via unsafe Java deserialization in `CosmosClientMetadataCachesSnapshot`, `AsyncCache`, and `DocumentCollection`. Added `SafeObjectInputStream` with class allowlisting to prevent deserialization of unauthorized classes.
+* Fixed Remote Code Execution (RCE) vulnerability via unsafe Java deserialization in `CosmosClientMetadataCachesSnapshot`, `AsyncCache`, and `DocumentCollection`. Added `SafeObjectInputStream` with class allowlisting to prevent deserialization of unauthorized classes. See [PR 47971](https://github.com/Azure/azure-sdk-for-java/pull/47971)
 
 #### Other Changes
 * Added `x-ms-hub-region-processing-only` header to allow hub-region stickiness when 404 `READ SESSION NOT AVAILABLE` is hit for Single-Writer accounts. - [PR 47631](https://github.com/Azure/azure-sdk-for-java/pull/47631)

sdk/cosmos/azure-cosmos/src/main/java/com/azure/cosmos/implementation/DocumentCollection.java

@@ -539,7 +539,9 @@ private void writeObject(ObjectOutputStream objectOutputStream) throws IOExcepti
 
         private void readObject(ObjectInputStream objectInputStream) throws IOException, ClassNotFoundException {
             Object obj = objectInputStream.readObject();
-            // Security fix: Validate that the deserialized object is the expected type
+            // Security fix: Validate that the deserialized object is the expected type before casting.
+            // Without this check, an attacker could provide a malicious object that would be blindly cast to ObjectNode,
+            // potentially leading to code execution vulnerabilities.
             if (!(obj instanceof ObjectNode)) {
                 throw new InvalidClassException(
                     "Expected ObjectNode but got " + 

sdk/cosmos/azure-cosmos/src/main/java/com/azure/cosmos/implementation/caches/AsyncCache.java

@@ -250,7 +250,8 @@ private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IO
             // (e.g., a crafted lambda that executes arbitrary code).
             // Instead, skip it and use the default equality comparer.
             // This is safe because:
-            // 1. All existing production code uses the default equality comparer
+            // 1. All existing production code uses the default equality comparer (verified by searching all
+            //    usages of "new AsyncCache<>" - they all use the no-arg constructor which creates the default comparer)
             // 2. The serialization format remains unchanged (we still write the comparer for backward compatibility)
             // 3. Future format changes should increment the serialVersionUID to handle compatibility explicitly
             Object unusedComparer = ois.readObject(); // Read and discard the serialized comparer to maintain format compatibility