Restrict XStream connection deserialization types

[belowzeroff]

Summary

• remove unrestricted XStream AnyTypePermission for saved connection XML
• deny all types by default and allow only the connection DTO/list/value types required for preferences

Testing

• Verified the bundled XStream 1.4.13 jar exposes the configured security APIs with javap
• Not run: full Ant build, because ant is not installed in this environment
• Targeted javac compile could not complete outside the project Ant setup because the current JDK/Lombok combination fails annotation processing and disabling processing exposes existing Lombok-generated symbol errors