Potential fix for code scanning alert no. 7: Arbitrary file access during archive extraction ("Zip Slip")

[ShadowDara]

Potential fix for https://github.com/ShadowDara/finder/security/code-scanning/7

General fix: when extracting archive entries, canonicalize the destination root and each candidate output path, then verify each candidate stays under the root using a robust relative-path check (filepath.Rel) before any filesystem operation.

Best targeted fix in internal/bt/gitrepo/gitrepo.go (inside restoreZip):

• Compute rootAbs once after creating destination.
• For each entry:
  • Keep existing name normalization and basic unsafe-name checks.
  • Build target and resolved absolute paths.
  • Replace prefix-based containment logic with:
    • rel, err := filepath.Rel(rootAbs, resolved)
    • reject if rel == ".." or starts with ".."+separator or is absolute.
• Use rootAbs instead of recalculating Abs(destination) each iteration.

No new dependencies are required; existing imports are sufficient.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.