RFR: 8321053: Use ByteArrayInputStream.buf directly when parameter of transferTo() is trusted [v3]

[Brian Burkhalter]

> Pass `ByteArrayInputStream.buf ` directly to the `OutputStream` parameter of `BAIS.transferTo` only if the target stream is in the `java.io` package.

Brian Burkhalter has updated the pull request incrementally with one additional commit since the last revision:

  8321053: Constrain trusted OutputStreams to a limited set

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/16893/files
  - new: https://git.openjdk.org/jdk/pull/16893/files/176d5165..29ee889b

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=16893&range=02
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=16893&range=01-02

  Stats: 8 lines in 2 files changed: 4 ins; 1 del; 3 mod
  Patch: https://git.openjdk.org/jdk/pull/16893.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/16893/head:pull/16893

PR: https://git.openjdk.org/jdk/pull/16893