fix: prevent archive path traversal (Android & iOS)

[pushpender-singh-ap]

Motivation

• Close a zip-slip/path traversal vulnerability in the native extraction code that trusted archive member names and could write/delete files outside the requested outputPath.
• Ensure the public unarchive(archivePath, outputPath) API cannot be abused to overwrite app-writable files outside the intended extraction directory.

Description

• Android (android/src/main/java/com/unarchive/UnarchiveModule.kt): strengthen isPathAllowed to use canonical path-boundary checks and add isSafeEntryPath entry validation that rejects blank or NUL-containing names, normalizes backslashes, blocks absolute entry names, canonicalizes the destination and enforces the destination is equal to or under the temporary extraction directory before any filesystem writes.
• iOS (ios/Unarchive.mm): add canonicalPath:isWithinDirectory: and canonicalPathForPath: helpers and harden isOutputPathInSandbox and isSafePath to use canonical path-boundary checks and to reject absolute/unsafe entry names without stripping traversal components.
• iOS ZIP handling: validate ZIP entry names during SSZipArchive extraction by checking entry names in the extraction progress callback and fail the extraction if any entry is unsafe, and use canonical post-extraction checks to detect escaped files.
• Both platforms perform path-boundary containment checks (canonical equality or prefix-with-separator) rather than naive prefix matching to prevent bypasses via path normalization.

Testing

• Ran yarn typecheck (succeeded).
• Ran yarn lint (succeeded).
• Ran git diff --check (no whitespace/error issues reported).
• Ran yarn test --runInBand (failed because the existing Jest suite contains no tests; this is an unrelated repo test-suite state issue).
• Attempted Android compile cd example/android && ./gradlew :react-native-unarchive:compileDebugKotlin (blocked in this environment due to Gradle/JDK mismatch: Unsupported class file major version 69).

---

Codex Task