Add SuppressBanSerializableForAndroid annotation

Serialization on Android has a different threat model and requires different solution. Add this new annotation so that it's easier for ISE Hardening to tell these apart from problems in backend code.

PiperOrigin-RevId: 693813292

core/src/test/java/com/google/errorprone/bugpatterns/testdata/BanSerializableReadNegativeCases.java

@@ -114,6 +114,19 @@ public static final void directCall3() throws IOException, ClassNotFoundExceptio
     self.readObject(deserializer);
   }
 
+  // code is for Android
+  @SuppressWarnings("BanSerializableRead")
+  public static final void directCall4() throws IOException, ClassNotFoundException {
+    PipedInputStream in = new PipedInputStream();
+    PipedOutputStream out = new PipedOutputStream(in);
+
+    ObjectOutputStream serializer = new ObjectOutputStream(out);
+    ObjectInputStream deserializer = new ObjectInputStream(in);
+
+    BanSerializableReadPositiveCases self = new BanSerializableReadPositiveCases();
+    self.readObject(deserializer);
+  }
+
   // calls to readObject should themselves be excluded in a readObject method
   void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
     BanSerializableReadNegativeCases c = new BanSerializableReadNegativeCases();