v0.52.3

fix: re-validate archive paths after applying strip (#575)

Archive path computation validated the entry path before applying
`strip`, then joined the remainder to the destination without
re-checking, so the result could fall outside the destination directory.
This applies to all multi-file extractors (tar, zip, 7z, rpm) via the
shared path helper.

Re-validates the path after `strip`, and tightens `sanitizeExtractPath`
to require a path separator after the destination so a sibling sharing
its name as a prefix is not accepted.

Adds regression tests.

Co-authored-by: Amp <amp@ampcode.com>