Wip 0.4.1

[dpieski]

Description

Security hardening and cleanup for archive extraction, HTTP retry behavior, and build configuration.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring

Changes

• fix: sanitize download filenames to prevent path traversal — Validate filenames in _save_response_to_file() to prevent directory escape
• fix: add download path validation and zip-bomb protection — Per-member extraction with _is_safe_path() check and optional max_size limit in _extract_archive()
• fix: skip symlinks during archive extraction — Skip symbolic links and hard links in both tar and zip archives rather than extracting them to disk
• fix: enable retries for POST requests — Add allowed_methods={"GET", "POST"} to Retry() so POST-based search endpoints are retried on 429/5xx errors
• fix: enforce keyword-only arguments in get_IFW_metadata
• refactor: remove unused utils.http module and ALLOWED_METHODS — Dead code that duplicated USPTOConfig._create_session() with different settings
• chore: optimize tox deps and enable parallel — Replace full dev dependency install with test-only deps; enable parallel = auto
• docs: improve README structure and add ADVANCED.md content — Session lifecycle, extraction safety, and missing usage examples

Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this manually (if applicable)

New tests:

• TestSaveResponseToFilePathTraversal — path traversal in download filenames
• TestExtractArchive — path traversal, zip bomb, and directory handling in archives
• TestExtractArchiveSymlinks — symlink/hardlink skipping for tar and zip
• test_session_retries_post_requests — POST included in retry allowed methods

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Related Issues

N/A

Additional Notes

• utils.http module removed entirely — create_session() and parse_response() were unused by any client
• Tox environments now install ~6 packages instead of ~40+, and run in parallel