Use OKHTTP in Jenkins plugin results in marshaling blacklist error

Question

I am attempting to use the okHTTP library within my Jenkins plugin to make some external HTTP requests to an API.

For example I have something like:

JSONObject post(String url, String json, String authHeader) throws IOException {
        RequestBody body = RequestBody.create(JSON, json);
        Request.Builder requestBuilder = new Request.Builder()
            .url(url)
            .addHeader("client_id", getClientId())
            .post(body);
        if (authHeader != null ){
            requestBuilder.addHeader("Authorization", "Bearer " + authHeader);
        }
        Request request = requestBuilder.build();
        try (Response response = client.newCall(request).execute()) {
          return new JSONObject(response.body().string());
        }

In my test instance (by running mvn hpi:run) this all works well.

However when i build the plugin and install it in a running Jenkins instance I end up with an error like:

   Mar 09, 2022 3:55:36 PM WARNING hudson.init.impl.InstallUncaughtExceptionHandler handleException
Caught unhandled exception with ID 63dbc350-15e9-44fd-afdc-c21c4b7652fd
java.lang.UnsupportedOperationException: Refusing to marshal okhttp3.ConnectionPool for security reasons; see https://www.jenkins.io/redirect/class-filter/
    at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:576)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:68)
    at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:59)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:83)
    at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:279)
    at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:266)
Caused: java.lang.RuntimeException: Failed to serialize okhttp3.OkHttpClient#connectionPool for class okhttp3.OkHttpClient
...

Looking online I can see that I can whitelist classes by creating a file at src/main/resources/META-INF/hudson.remoteing.ClassFilter and adding the classes to that file.

However I now have 15 classes in that file and its still growing and giving the same error etc.

SO my question is whats the correct way to actually do this?

Using a wild card like okhttp3.* in the above file doesnt seem to work.

How can i whitelist the whole of okhttp?