Stop json/plain from allocating arbitrary classes (0.0.7)

[d2army]

Summary

Oj object mode can allocate any Ruby class named in a json/plain payload. This PR allowlists what may round-trip, then loads the original bytes so existing encoded history still works. Encoding name stays json/plain. Version is 0.0.7.

deserialize runs three steps, in this order:

1. Streaming walk (Oj::Saj): reject duplicate object keys and nesting deeper than 512. Saj has to run first. JSON.parse keeps the last duplicate key; Oj binds ^o on the first, so a discarded object or array can still allocate a class.
2. Allowlist on the JSON.parse tree: only loaded Temporal:: types, loaded ::Request / ::Response, loaded Exception subclasses, Date-like types, anonymous Structs, and Temporal::JSON.allow_class.
3. Oj.load of the original bytes: keep Time (^t) and symbol keys.

Do not tighten ^c. It returns a Class object (not an instance) when an exception ivar holds a class.

How to review

Start here:

1. lib/temporal/json.rb — whole guard. File header is the map. Then PayloadStructureValidator#note (why keys are recorded on hash and array start), then allowed_* / allow_class.
2. lib/temporal/errors.rb — JSONDisallowedClassError.
3. lib/temporal/concerns/input_deserializer.rb — also rescue JSON::ParserError so newline-split Go-client input still works. Do not swallow JSONDisallowedClassError.

Then, only if you are checking packaging or CI:

• temporal.gemspec — google-protobuf ~> 3.25 because generated stubs do not load on protobuf 4.
• .github/workflows/tests.yml — CI now runs on transfers-master PRs (it did not before). docker compose v2, wait-for-7233, and image pins are so example CI actually starts Temporal.
• spec/unit/lib/temporal/json_spec.rb — first-party round-trips that broke on the first fail-closed pass, then attack/duplicate-key regressions.

Test plan

• bundle exec rspec spec/unit (643 examples, 0 failures)
• Gadgets (Gem::Requirement, Kernel) and duplicate keys (both value orderings, including ^u) raise before Oj.load
• Nesting 512 accepted, 513 rejected; autoload-pending constants are not loaded
• Request/Response, exceptions with backtraces, Date, anonymous Struct, json/plain encoding name
• Go-client newline input still deserializes
• GitHub Actions test_gem and test_examples
• After publish: consumers can pin temporal-ruby 0.0.7 instead of a git SHA