fix(security): zip decode limits trust the size declared in the archive header (zip-bomb bypass) #1561

Problem

SafeZipExtractor._validateArchive (lib/core/security/safe_zip_extractor.dart:141-166) enforces the per-entry, total and compression-ratio limits using entry.size, which is the uncompressed size declared in the zip header.

In archive 4.4.0 that value is only a hint for the initial buffer (codecs/zip/zip_file.dart: "uncompressedSize is only a hint for the initial buffer"). A crafted zip that declares 1 KB can inflate to gigabytes on file.content, so all four limits can be bypassed. Affects marketplace install, sideload (no sha256 there, the file is user-chosen) and the updater.

Expected

• Extract with a bounded streaming inflate that counts actual bytes written, per entry and in total, and aborts when a limit is exceeded.
• Keep the header-based pre-check as a cheap early reject.
• Test with a zip whose header lies about the size.