[OPENJPA-2984] Record why an id class is no longer checked for Serializable

[rzo1]

To answer the review question: the check was not lost in the rewrite, and the warning should not come back.

Jakarta Persistence 3.2 section 2.4.1 dropped both the public and the Serializable requirement for a primary key class — the release notes say so verbatim — and bf3d2b1 removed the warning deliberately: the same commit deleted the id-class-not-serializable message key, relaxed the matching public-ness rules in the kernel (getConstructor → getDeclaredConstructor, setAccessible), and added TestNonPublicIdClass with a package-private, non-serializable id class. Restoring the warning would fire against metadata the specification allows, including that test's own entity, and against 29 of the 67 @IdClass targets in our test sources.

What was missing is the reason, so both parsers now carry it where the check used to be, along with the consequence that does survive: a non-serializable id class cannot be used where OpenJPA serializes the identity object wrapping it — serializing a detached entity, remote commit events, a distributed data cache — which fails with a NotSerializableException naming the class.

The manual still listed the pre-3.2 rules, so the identity class criteria are corrected. Note the constructor requirement is only that a no-args one exists, of any visibility, since validateAppIdClassMethods uses getDeclaredConstructor(); a record has none, so a record @IdClass is rejected.

No behaviour change. TestNonPublicIdClass already pins the relaxation and would fail if anyone reinstated a hard check.