feat: refine python module check (#2952)

<!--
**Thanks for contributing to Apache Fory™.**

**If this is your first time opening a PR on fory, you can refer to
[CONTRIBUTING.md](https://github.com/apache/fory/blob/main/CONTRIBUTING.md).**

Contribution Checklist

- The **Apache Fory™** community has requirements on the naming of pr
titles. You can also find instructions in
[CONTRIBUTING.md](https://github.com/apache/fory/blob/main/CONTRIBUTING.md).

- Apache Fory™ has a strong focus on performance. If the PR you submit
will have an impact on performance, please benchmark it first and
provide the benchmark result here.
-->

## Why?

<!-- Describe the purpose of this PR. -->

## What does this PR do?

<!-- Describe the details of this PR. -->

## Related issues

<!--
Is there any related issue? If this PR closes them you say say
fix/closes:

- #xxxx0
- #xxxx1
- Fixes #xxxx2
-->

## Does this PR introduce any user-facing change?

<!--
If any user-facing interface changes, please [open an
issue](https://github.com/apache/fory/issues/new/choose) describing the
need to do so and update the document if necessary.

Delete section if not applicable.
-->

- [ ] Does this PR introduce any public API change?
- [ ] Does this PR introduce any binary protocol compatibility change?

## Benchmark

<!--
When the PR has an impact on performance (if you don't know whether the
PR will have an impact on performance, you can submit the PR first, and
if it will have impact on performance, the code reviewer will explain
it), be sure to attach a benchmark data here.

Delete section if not applicable.
-->

Author: chaokunyang

python/pyfory/serializer.py

@@ -1476,12 +1476,14 @@ def write(self, buffer, value):
         buffer.write_string(value.__name__)
 
     def read(self, buffer):
-        mod = buffer.read_string()
-        mod = importlib.import_module(mod)
-        result = self.fory.policy.validate_module(mod.__name__)
+        mod_name = buffer.read_string()
+        result = self.fory.policy.validate_module(mod_name)
         if result is not None:
-            mod = result
-        return mod
+            if isinstance(result, types.ModuleType):
+                return result
+            assert isinstance(result, str), f"validate_module must return module, str, or None, got {type(result)}"
+            mod_name = result
+        return importlib.import_module(mod_name)
 
 
 class MappingProxySerializer(Serializer):

python/pyfory/tests/test_policy.py

@@ -259,3 +259,35 @@ def __reduce__(self):
 
     with pytest.raises(ValueError, match="Inner is blocked"):
         fory.deserialize(data)
+
+
+def test_validate_module():
+    """Test validate_module policy hook for module deserialization."""
+    import json
+    import collections
+
+    # Test 1: Return module object directly
+    class ReturnModulePolicy(DeserializationPolicy):
+        def validate_module(self, module_name, **kwargs):
+            return collections
+
+    fory1 = Fory(ref=True, strict=False, policy=ReturnModulePolicy())
+    data = fory1.serialize(json)
+    assert fory1.deserialize(data) is collections
+
+    # Test 2: Return string to redirect import
+    class RedirectPolicy(DeserializationPolicy):
+        def validate_module(self, module_name, **kwargs):
+            return "collections" if module_name == "json" else None
+
+    fory2 = Fory(ref=True, strict=False, policy=RedirectPolicy())
+    assert fory2.deserialize(fory2.serialize(json)).__name__ == "collections"
+
+    # Test 3: Raise to block module
+    class BlockPolicy(DeserializationPolicy):
+        def validate_module(self, module_name, **kwargs):
+            raise ValueError(f"Module {module_name} blocked")
+
+    fory3 = Fory(ref=True, strict=False, policy=BlockPolicy())
+    with pytest.raises(ValueError, match="blocked"):
+        fory3.deserialize(fory3.serialize(json))