Lucky should ignore memoized variables in serialized JSON

If you have an object that includes JSON::Serializable, and that object also uses memoize in there, Lucky will create an instance variable for that memorized method:

https://github.com/luckyframework/lucky/blob/ab0db6ab0ad40685fbb13230fe7a224b5914898d/src/lucky/memoizable.cr#L43

Serializable takes all instances variables and adds them to the whole JSON document. You can sort of see an example here:

require "json"

module Memoizable
  @__memoized_value : String?

  macro memoize(method_def)
    def {{ method_def.name }}
      @__memoized_value ||= {{ method_def.body }}
    end
  end
end


class Server
  include JSON::Serializable
  include Memoizable

  property host : String

  memoize def foo
    "hello"
  end
end

server = Server.from_json(%({"host": "localhost"}))
server.foo
puts server.to_json

Notice that when the server is printed out, the json also includes the memoized value. This is almost certainly unintended data being shipped over.

However, there may come a time where you actually do want to send that value... In that case, we need to make sure to allow for the opt-in

@[JSON::Field]
memoize def foo
  "hello"
end

Start with src/lucky/memoizable.cr around line 43 and reproduce the issue using the Crystal example in the report with JSON::Serializable. Verify that memoized instance variables are excluded from serialized JSON by default, while the shown JSON::Field annotation provides the opt-in behavior.