Motivation

• Enrich the repository README with curated foundational resources to help learners build Java security knowledge systematically.
• Provide clear, opinionated study sequences for core topics including general Java security, deserialization, and JSON deserialization libraries.
• Make the learning roadmap more actionable by grouping essential references and defensive guidance in one place.

Description

• Added 1.1 Java安全基础技术补充 with curated links for JVM/JLS, concurrency model, OWASP/CWE references, Tomcat/Servlet docs, dependency supply-chain tooling, and secure coding cheat sheets.
• Added 1.2 建议学习顺序 to recommend an ordered path for core Java security topics.
• Added 2.1 反序列化基础技术补充 and 2.2 建议学习顺序 with links to the Java Object Serialization Specification, JEP 290, CWE-502, OWASP deserialization guidance, and ysoserial tooling.
• Added 3.1 JSON反序列化基础技术补充 and 3.2 建议学习顺序 covering Jackson and Fastjson references, CVE/typing guidance, and an API risk perspective.

Testing

• This is a documentation-only change and no automated tests were added or required.
• No existing automated tests were run as part of this change and no failures occurred because no code was modified.

Codex Task