security(archive): zip bomb limits and bounded decompression for extension/updater installs

[ZhuchkaTriplesix]

Summary

Archive extraction paths load the entire zip into memory and decode without limits on:

• compressed / uncompressed size
• number of entries
• compression ratio (zip bomb)

Comment in code references Issue #242 (path traversal — closed), but zip-bomb protection was not implemented.

Affected code

• lib/core/market/http_marketplace_repository.dart (readAsBytes + ZipDecoder().decodeBytes)
• lib/core/extensions/local_extension_installer.dart
• lib/core/updater/installers/update_install_utils.dart

Proposed fix

Introduce shared SafeZipExtractor (or similar) with configurable limits, e.g.:

• max compressed bytes read
• max total uncompressed bytes
• max file count
• max per-entry uncompressed size
• max compression ratio

Stream or bound reads where possible; fail closed with MarketplaceException / AppUpdaterException.

Acceptance criteria

• Shared limits used by marketplace, sideload, and updater extract paths.
• Tests with oversize archive / too many entries / high-ratio zip bomb fixture.
• Document limits in docs/security.md or marketplace docs.

Severity

Medium — DoS (memory exhaustion) via malicious or compromised extension/update archive.

Related

• Closed security(extensions): защита от Path Traversal при распаковке архивов тем и плагинов #242 (path traversal only)
• Security review 0.4.11