CVE-2020-24164: Gadget chain attack in Nippy

The vulnerability stems from Nippy's automatic use of Java Serializable interface without proper validation. The commit diff shows: 1) Added serializable-whitelist to gate Serializable usage 2) Modified write-serializable to check this whitelist before writing objects 3) Created read-serializable-depr1 to handle legacy serialization with security checks. The original write-serializable and read-serializable functions lacked these protections, allowing arbitrary class deserialization. This matches the CWE-502 pattern where untrusted data deserialization occurs without proper validation, enabling RCE through malicious payloads.