fix: make ApiTokenAttribute Serializable for Ehcache L2 cache (#24002)

Ehcache 3.12.0 uses SerializingCopier which requires Java
serialization. ApiTokenAttribute (and subclasses MethodAllowedList,
IpAllowedList, RefererAllowedList) lacked Serializable, causing
500 errors on /api/me and /api/apiTokens when PATs exist.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: netroms

dhis-2/dhis-api/src/main/java/org/hisp/dhis/security/apikey/ApiTokenAttribute.java

@@ -33,6 +33,7 @@
 import com.fasterxml.jackson.annotation.JsonSubTypes;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+import java.io.Serializable;
 import org.hisp.dhis.common.DxfNamespaces;
 import org.hisp.dhis.common.EmbeddedObject;
 
@@ -49,7 +50,7 @@
   @JsonSubTypes.Type(value = MethodAllowedList.class, name = "MethodAllowedList")
 })
 @JacksonXmlRootElement(localName = "apiTokenAttribute", namespace = DxfNamespaces.DXF_2_0)
-public abstract class ApiTokenAttribute implements EmbeddedObject {
+public abstract class ApiTokenAttribute implements EmbeddedObject, Serializable {
   protected final String type;
 
   protected ApiTokenAttribute(String type) {