Validate java package and class against injection risks.

This risk is outside of our threat model, but for defense-in-depth we will rejecting it at protoc time.

Credit to @chupaohong for identifying this concern.

Fixes https://github.com/protocolbuffers/protobuf/issues/26833

PiperOrigin-RevId: 900864594