Fix security vulnerability in archive extraction

[kolega-dev-github-app]

Summary

This PR addresses a security vulnerability in the archive extraction logic that could allow path traversal attacks. The fix ensures the extraction process is secure and follows best practices.

Changes

• Implemented a custom PathTraversalError class to handle and report path traversal attempts
• Added multiple layers of validation to the validateZipEntryPath function to catch various attack vectors:
  • Input sanitization to reject obviously malicious input
  • Pre-resolution validation to catch traversal before path normalization
  • Post-resolution validation to verify the final extracted path is within the destination directory
• Normalized path separators to platform-native format for consistent handling
• Checked for Windows reserved names and drive letters to prevent escaping the destination directory

Testing

The changes can be tested by running the unit tests for the archive.ts module, which now include additional test cases for the path validation logic.