Add insecure deserialization review skill

[xiefuzheng713-alt]

Summary

/claim #253

Adds a focused insecure-deserialization-review AppSec skill for Java and Python deserialization risks. The skill covers native object streams, pickle-family loaders, unsafe YAML constructors, polymorphic type binding, side-effect hooks, integrity controls, replay/migration concerns, and safe replacement patterns.

What changed

• Added skills/appsec/insecure-deserialization-review/SKILL.md with scope inventory, detection checklist, severity guidance, output format, remediation guidance, and false-positive controls.
• Added a short README and reference pattern matrix.
• Added 3 vulnerable fixtures and 3 benign fixtures covering Java and Python examples.
• Registered the skill in index.yaml and incremented skill_count.

Validation

• git diff --check
• git diff --cached --check
• Full required-frontmatter check across skills/ and roles/
• index.yaml listed-file existence check
• Prompt-injection pattern check equivalent to .github/workflows/injection-scan.yml
• python -m py_compile on the new Python fixtures, with generated __pycache__ removed before commit

Closes #253