Restrict trusted packages in ReflectData and SpecificData

Right now, there's no check in allowed packages in ReflectData and SpecificData.

That could be problematic for marshalling/unmarshalling, as the as malicious payload can exploit the host system.

I propose to introduce a org.apache.avro.TRUSTED_PACKAGES system property:

-Dorg.apache.avro.TRUSTED_PACKAGES=my.package,my.other.package,...

In case we want to shortcut the mechanism, we would be able to allow all packages to be trusted using * wildcard:

-Dorg.apache.avro.TRUSTED_PACKAGES=*

By default, I would recommend to have limited trusted packages: java.lang,javax.security,java.util,org.apache.avro.