Validate zip directory entries during extraction

[dfgvaetyj3456356-hash]

Summary

• validate zip entry paths before creating directory entries during extraction
• keep the same containment check for file entries
• add a regression test for ../ directory entries that previously could create directories outside the extraction target

Why

FileUtil.extract checked normalized paths for file entries, but directory entries were created before any containment validation. A crafted archive with a directory entry such as ../outside/ could therefore create directories outside the intended extraction root.

Testing

• git diff --check

I could not run the Scala test suite locally because this Windows environment does not have sbt, scala, scalac, or java on PATH.