Fix ZipSlip path traversal vulnerability in ArtifactTool zip extraction

[Copilot]

_redirect_artifacts_tool_path was calling ZipFile.extractall() directly without validating member paths, leaving it open to ZipSlip/path traversal attacks where a malicious zip could write files outside the intended temp directory.

Changes

• _artifact_utils.py: Replace extractall() with member-by-member extraction using infolist() (covers directories as well as files); resolve each member's path and assert it stays within the target directory before extracting; raise RuntimeError on any unsafe entry.

artifacts_tool_resolved = Path(artifacts_tool_path).resolve()
for member_info in zip_file.infolist():
    member_resolved = (artifacts_tool_resolved / member_info.filename).resolve()
    if not member_resolved.is_relative_to(artifacts_tool_resolved):
        raise RuntimeError(
            f"Unsafe path in zip archive: '{member_info.filename}' resolves outside the target directory."
        )
    zip_file.extract(member_info, artifacts_tool_path)