ObjectInputFilter per-stream deserialization guard?

Per-stream ObjectInputFilter

Beyond global filters, each ObjectInputStream can set an ObjectInputFilter that inspects class descriptors, array sizes, and graph depth before instantiating objects.