Use safe Marshal deserialization for dependency API response.

[simi]

ℹ️ I'm looking at introducing real-word spec to cover the real response from Dependency API as well.

[simi]

🤔 I'm not sure why TrueClass is needed, but it is passed to proc even not part of the structure.

irb(main):013:0> simple_structure = { "name" => [:abc] }
=> {"name"=>[:abc]}
irb(main):014:0> Marshal.load(Marshal.dump(simple_structure), ->(object) { object.tap { puts object.class }})
TrueClass
String
Symbol
Array
Hash
=> {"name"=>[:abc]}

[simi]

I was able to strip this down to string deserialization.

Marshal.load(Marshal.dump('string'), ->(o) { o.tap { puts o.class } })
String
TrueClass

[composerinteralia]

In case it's useful, I think TrueClass is related to the string encoding. That seems to be what the ET at the end of the dump is about:

Marshal.dump('string')
#=> "\x04\bI\"\vstring\x06:\x06ET"

whereas we get false in this case:

Marshal.dump('string'.encode!('ASCII'))
#=> "\x04\bI\"\vstring\x06:\x06EF"

or a string for other encodings:

Marshal.dump('string'.encode!('ISO-8859-1'))
#=> "\x04\bI\"\vstring\x06:\rencoding\"\x0FISO-8859-1"

[indirect]

This seems good for the dependency API! Can we also use SafeMarshal for loading Marshal.4.8.specs.gz and latest_specs? Could be in another PR if that's easier.

[simi]

@indirect those includes Gem::Version, I'll open another PR to handle those as well.