lib/serialization: make `serialize_reference` protected