Security::CiConfiguration::BaseCreateService tries to load Gitlab::Ci::Config::Yaml::Tags::Reference

In https://log.gprd.gitlab.net/goto/29d31e80-0def-11ed-8656-f5f2137823ba, we see YAML.safe_load in https://gitlab.com/gitlab-org/gitlab/-/blob/dd1e70d3676891025534dc4a1e89ca9383178fe7/app/services/security/ci_configuration/base_create_service.rb#L45 failing:

Tried to load unspecified class: Gitlab::Ci::Config::Yaml::Tags::Reference

"exception.backtrace": [
        "app/services/security/ci_configuration/base_create_service.rb:45:in `existing_gitlab_ci_content'",
        "app/services/security/ci_configuration/container_scanning_create_service.rb:9:in `action'",
        "app/services/security/ci_configuration/base_create_service.rb:39:in `attributes'",
        "app/services/security/ci_configuration/base_create_service.rb:17:in `execute'",
        "ee/app/graphql/mutations/security/ci_configuration/configure_container_scanning.rb:15:in `configure_analyzer'",
        "app/graphql/mutations/security/ci_configuration/base_security_analyzer.rb:24:in `resolve'",
        "lib/gitlab/graphql/present/field_extension.rb:18:in `resolve'",
        "lib/gitlab/graphql/tracers/timer_tracer.rb:20:in `trace'",
        "lib/gitlab/graphql/generic_tracing.rb:48:in `with_labkit_tracing'",
        "lib/gitlab/graphql/generic_tracing.rb:38:in `platform_trace'",
        "lib/gitlab/graphql/tracers/logger_tracer.rb:14:in `trace'",
        "lib/gitlab/graphql/tracers/metrics_tracer.rb:13:in `trace'",
        "lib/gitlab/graphql/tracers/application_context_tracer.rb:23:in `trace'",
        "lib/gitlab/graphql/tracers/timer_tracer.rb:20:in `trace'",
        "lib/gitlab/graphql/generic_tracing.rb:48:in `with_labkit_tracing'",
        "lib/gitlab/graphql/generic_tracing.rb:38:in `platform_trace'",
        "lib/gitlab/graphql/tracers/logger_tracer.rb:14:in `trace'",
        "lib/gitlab/graphql/tracers/metrics_tracer.rb:13:in `trace'",
        "lib/gitlab/graphql/tracers/application_context_tracer.rb:20:in `block in trace'",
        "lib/gitlab/application_context.rb:103:in `block in use'",
        "lib/gitlab/application_context.rb:103:in `use'",
        "lib/gitlab/application_context.rb:48:in `with_context'",

I can't seem to reproduce it locally:

[ gprd ] production> project = Project.find(36067776); nil
=> nil
[ gprd ] production> gitlab_ci_yaml = project.ci_config_for(project.repository.root_ref_sha); nil
=> nil
[ gprd ] production> YAML.safe_load(gitlab_ci_yaml)
=> {"include"=>[{"project"=>"REDACTED/ci/pipelines", "ref"=>"master", "file"=>"/github-k8s-application.yml"}], "variables"=>{"BUILD_DOCKER_FILE"=>"Dockerfile", "DEPLOY_HELM_CHART"=>"helm/authority", "DEPLOY_HELM_RELEASE_NAME_DEVELOP"=>"authority-develop", "DEPLOY_HELM_RELEASE_NAME_STAGING"=>"authority-staging", "DEPLOY_HELM_RELEASE_NAME_MASTER"=>"authority-master", "DEPLOY_HELM_VALUES_DEVELOP"=>"helm/authority/values-develop.yaml", "DEPLOY_HELM_VALUES_STAGING"=>"helm/authority/values-staging.yaml", "DEPLOY_HELM_VALUES_MASTER"=>"helm/authority/values-master.yaml"}, "lint-golangci"=>{"extends"=>[".shell-runner"], "stage"=>"test", "script"=>"make lint-golangci"}, "test-unit"=>{"extends"=>[".shell-runner"], "stage"=>"test", "script"=>"make test-unit"}, "docker"=>{"extends"=>[".docker"], "before_script"=>[[".docker", "before_script"], "make vendor-install"]}}

I'm not sure why this would happen since @gitlab_ci_yaml should just be raw blob data. Maybe it was loaded already?

At first I thought this was related to the Rails v6.1.6.1 upgrade in !92400 (merged), but this seems like a separate issue.