Disable SRL_RB_OBJECT decoding, unless requested

After recent security problems with deserializing stuff into arbitrary objects,
maybe it will be best to let the user decide if he/she can trust the input data.
Sereal.decode(data) will not decode SRL_RB_OBJECT tag but Sereal.decode(data,false)
will spawn arbitrary objects.