Whitelist YAML classes demarshalled from metadata

This is a temporary fix which should prevent the same injection vector being used again.

I'm going to gauntlet all gems through the upload process to see if there are any uncaught classes.