Fields in a Serializable class must be transient or Serializable

[bencomp]

SonarQube found (as of commit a0bc225) 374 violations of the rule "Fields in a Serializable class should either be transient or serializable", marking these violations as critical issues.

Rationale:

Fields in a Serializable class must themselves be either Serializable or transient even if the class is never explicitly serialized or deserialized. That's because under load, most J2EE application frameworks flush objects to disk, and an allegedly Serializable object with non-transient, non-serializable data members could cause program crashes, and open the door to attackers.

I recognise the described J2EE application framework behaviour, as at times our DVN 3.6 installation, that also has plenty of violations like these, tries to serialise the EntityManager to disk and then complains in lots of log lines that it's not serializable.

Serializable classes should also have a private static final long serialVersionUID, but that is only a 'minor' issue in SonarQube's default quality profile, not a critical one.

[pdurbin]

Closing to consolidate into #3950.