Add fast-path and use Class keys in AllowlistReturnTypeValidator

String/Number/Boolean are always allowed return types, so skip the
ConcurrentHashMap lookup entirely. Also changed the cache key from
String (canonical class name) to Class<?> to avoid the cost of
getCanonicalName() on cache hits.

Benchmark: +64% throughput on complexTemplateBenchmark (3,316 -> 5,428 ops/s)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jasmith-hs

src/main/java/com/hubspot/jinjava/el/ext/AllowlistReturnTypeValidator.java

@@ -11,7 +11,7 @@ public final class AllowlistReturnTypeValidator {
     AllowlistReturnTypeValidator.create(
       ReturnTypeValidatorConfig.builder().addDefaultAllowlistGroups().build()
     );
-  private final ConcurrentHashMap<String, Boolean> allowedReturnTypesCache;
+  private final ConcurrentHashMap<Class<?>, Boolean> allowedReturnTypesCache;
 
   private final ImmutableSet<String> allowedCanonicalClassPrefixes;
   private final ImmutableSet<String> allowedCanonicalClassNames;
@@ -47,16 +47,22 @@ public Object validateReturnType(Object o) {
     if (o == null) {
       return null;
     }
+    if (o instanceof String || o instanceof Number || o instanceof Boolean) {
+      return o;
+    }
     Class<?> clazz = o.getClass();
     if (clazz.isArray() && allowArrays) {
       return o;
     }
-    String canonicalClassName = clazz.getCanonicalName();
     boolean isAllowedClassName = allowedReturnTypesCache.computeIfAbsent(
-      canonicalClassName,
-      c ->
-        allowedCanonicalClassNames.contains(canonicalClassName) ||
-        allowedCanonicalClassPrefixes.stream().anyMatch(canonicalClassName::startsWith)
+      clazz,
+      c -> {
+        String canonicalClassName = c.getCanonicalName();
+        return (
+          allowedCanonicalClassNames.contains(canonicalClassName) ||
+          allowedCanonicalClassPrefixes.stream().anyMatch(canonicalClassName::startsWith)
+        );
+      }
     );
     if (!isAllowedClassName) {
       onRejectedClass.accept(clazz);