Fixed: Extend allowlist in SafeObjectInputStream to include GString* Groovy classes

The classes are also already included in the configurable allow list in SafeObjectInputStream.properties

Author: jacopoc

framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java

@@ -66,7 +66,9 @@ public final class SafeObjectInputStream extends ObjectInputStream {
             "java\\.util\\.TreeMap",
             "java\\.util\\.Arrays\\$ArrayList",
             "org\\.apache\\.ofbiz\\.entity\\.GenericValue",
-            "org\\.apache\\.ofbiz\\.entity\\.GenericPK"};
+            "org\\.apache\\.ofbiz\\.entity\\.GenericPK",
+            "org\\.codehaus\\.groovy\\.runtime\\.GStringImpl",
+            "groovy\\.lang\\.GString"};
     private static final String[] DEFAULT_DENYLIST = {"rmi", "<"};
 
     /** The regular expression used to match serialized types. */