GHSA-pjwx-r37v-7724: LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

LangChain has a vulnerability where older code paths deserialize (convert serialized data back into objects) untrusted user input too broadly, allowing attackers to inject specially crafted LangChain objects that get instantiated with attacker-controlled arguments. The vulnerability only affects applications that accept untrusted structured input (like JSON), don't validate it first, and use affected APIs like `RunnableWithMessageHistory` or `astream_log()`.