Restrict property paths under Class and properties of types ClassLoader or ProtectionDomain.

Closes gh-28260

Comment From: bclozel

The team takes care of backporting issues. Thanks for the offer though!