Add `java.lang.Runnable` as unsafe base type in `DefaultBaseTypeLimitingValidator`

[cowtowncoder]

(note: not resulting from any specific threat but added as due diligence based on code review)

Currently (2.18.3) DefaultBaseTypeLimitingValidator a small number of "too permissive" types is included as blocked as base type. It seems like java.lang.Runnable should be included; it is not yet there.