Reported by: Yakov Shafranovich (yakovsh@amazon.com)

Problem:
ObjectInputStream::readObject() doesn't validate negative array lengths before calling Array::newInstance(), which throws
NegativeArraySizeException - an unchecked exception not declared in the method signature or documented in the API.

Impact:
• Users aren't aware they need to handle NegativeArraySizeException
• ObjectInputFilter.FilterInfo::arrayLength() violates its contract by returning negative values instead of the documented "non-negative
number"

Solution:
Add explicit negative array length validation in ObjectInputStream::readObject() before filtering, and wrap negative lengths in
InvalidClassException (a checked exception already declared in the method signature).

Benefits:
• Consistent exception handling through documented InvalidClassException
• Fixes ObjectInputFilter.FilterInfo::arrayLength() contract violation
• Better API usability and predictability