fix(OfficeUtils): strengthen ZipSlip path traversal protection in ZIP extraction

[maxm11]

Summary

Addresses Euro-Office/core#115 — Path Traversal in ZIP Extraction (ZipSlip).

Problem

The existing ZipSlip check in do_extract_currentfile() only rejected archive entries whose normalized path started with ../. This left several bypass vectors:

Payload	Old Check
../../../etc/passwd	Caught
foo/../../etc/passwd	Bypassed — normalized to ../../etc/passwd but the check only looked at the filename, not the full output path
/etc/passwd (Unix)	Bypassed — absolute paths were never rejected
`C:\Windows... (Windows)	Bypassed — drive-letter absolute paths were never rejected

Fix

Replaced the weak check with proper prefix-based containment validation:

1. Rejects empty normalized archive entry paths — catches degenerate entries like ./ or ..
2. Rejects absolute paths in archive entries:
   • Unix-like: /etc/passwd → rejected immediately
   • Windows: C:\Windows\... or \\server\share\... → rejected immediately
3. Prefix containment check — the core fix:
   • Normalizes both the output path and extraction directory via ShortenPath() to resolve all ../ and ./ components
   • Ensures the extraction directory ends with a separator for reliable prefix matching
   • Verifies normalized_output_path starts with normalized_extract_dir/
   • If not, returns UNZ_INTERNALERROR

Attack vectors now blocked

Payload	Old Check	New Check
../../../etc/passwd	✅ Caught	✅ Caught
foo/../../etc/passwd	❌ Bypassed	✅ Caught
/etc/passwd (Unix)	❌ Bypassed	✅ Caught
`C:\Windows... (Windows)	❌ Bypassed	✅ Caught
\\server\share\... (Windows)	❌ Bypassed	✅ Caught

Files changed

• OfficeUtils/src/ZipUtilsCP.cpp — replaced weak check with prefix-based containment validation in do_extract_currentfile()