Reject object references of the wrong class

toVariant() resolved a JSON object reference without checking that the
object is of the parameter's or property's class. A client could name
any object the channel has exposed to it and have a slot use it as an
unrelated type.

Reject the argument unless the resolved object inherits the target
metatype's metaobject, and reject when no metaobject is available to
check against. Apply the same check in conversionScore(), so overload
resolution does not select a candidate the argument cannot satisfy.

Pick-to: 6.8 6.12
Task-number: QTBUG-151083
Change-Id: I001e51bba581bf9496beb48c9b37d79caf5a35af
Reviewed-by: Arno Rehn <a.rehn@menlosystems.com>