Improve Hazelcast serialization

[vpavic]

HazelcastSessionRepository currently relies on standard Java serialization, which isn't the ideal option performance wise. We should look into leveraging Hazelcast's serialization mechanism like DataSerializable which should yield a nice performance improvement.

[oxc]

In order to fix the issue mentioned in #1319 (client-server topology with custom-class session entries), the solution must ensure that no session entries are deserialized on the server-side.
Switching to another form of serialization will probably not provide this without changing what is stored inside the session map, especially since the EntryProcessor holding the session delta must itself be java Serializable.

[enozcan]

As @oxc pointed out

the solution must ensure that no session entries are deserialized on the server-side.

This can be partially done via Portable serialization (more information here at #1671). No user code deployments or classes on the server's classpath would be needed if Portable applies. Moreover, it will have a considerable impact on the query performance of findByPrincipal case. But this will require to break backward compatibility. It's suggested to have this in the next major version (#1671 (comment)) and I will be happy to implement this.

Leaving the comment here to make this a sort of reminder for the issue.