Harden deserialization in HttpRestartServer

While remote code execution is a feature of remote DevTools,
hardening of the deserialization of ClassLoaderFiles is not without
benefit. Not least, it should prevent false-positive reports from
AI-based security scanners that look at the code in isolation without
understanding the full context of the feature.

It should be noted that this hardening in no way protects against
remote code execution and the use of remote DevTools remains an
opt-in feature that should only be enabled in a trusted setting and
secured with a sufficiently complex secret. It remains the case that
an attacker who compromises the secret and has network access to the
remote application can achieve RCE by uploading a serialized
ClassLoaderFiles payload that adds malicious code and/or resources
to the application.

Closes gh-50272