Require Java Serializable types to be whitelisted

[kuujo]

This PR fixes the security issue in #14. However, rather than taking the approach of overriding ObjectInputStream to whitelist class names, classes are whitelisted at the Serializer level instead. This implements Java serialization simply as another TypeSerializer. This means Serializable types are serialized to the buffer. If a Serializable type is registered then the type will be serialized with a type ID. When the type is read during deserialization, the class will be loaded by the type ID. This ensures that only classes that have been whitelisted can be loaded when deserializing a registered Serializable type. If an attacker attempts to load an arbitrary class by injecting a serializable type ID, they can only load a registered class.

The flaw does still exist for Serializable types that are serialized without having been registered/whitelisted. If a Serializable object is serialized without having been registered, the class name will be serialized and deserialized. However, this feature is disabled by default. The user must explicitly disable whitelisting to allow class names to be serialized at all. If whitelisting is enabled, an exception will be thrown prior to loading any class during deserialization.