Block more JDK gadget types (com.sun.rowset)

[cowtowncoder]

(note: follow-up on #1599)

Looks like there is at least one other "well-known" type to block besides 9 already added (an impl class for database drivers): com.sun.rowset.JdbcRowSetImpl

Fixed in:

• 2.9.0 and all later
• 2.8.10
• 2.7.9.2
• 2.6.7.3

[cowtowncoder]

Fixed for 2.8.10, 2.9.0; and if released, 2.7.10 (added post 2.7.9.1).

[cowtowncoder]

For further info: https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062