harden: safe ZIP extraction, checksums, and bounded reads for extension/preset downloads#3141

PascalThuet wants to merge 2 commits into

github:maingithub/spec-kit:mainfrom

PascalThuet:split/extension-preset-downloadsPascalThuet/spec-kit:split/extension-preset-downloadsCopy head branch name to clipboard