AVRO-3985: Prevent class with empty Java package being trusted by SpecificDatumReader

[MichalFoksa]

What is the purpose of the change

Prevents class with empty Java package being trusted by SpecificDatumReader.

"package is not here"

import java. ...
import org. ....

public class Foot {
  ...
}

For example the above class Foo used as a key or a value would be considered as trusted because in current code
clazz.getPackage() returns null for Foo.class, which bypassed if (!found) then throw exception check.

PR moves if (!found) then throw exception bellow if (thePackage != null) { ... } statement.

It complements AVRO-3985.

Verifying this change

This change is a trivial rework / code cleanup without any test coverage.

Documentation

• Does this pull request introduce a new feature? no

[martin-g]

Thank you, @MichalFoksa !
Backported it to branch-1.11 and branch-1.12

[MichalFoksa]

@martin-g You are welcome!