Reduce cyclomatic complexity of SafeZipExtractor::assertEntryIsSafe (Codacy)

[jbagsik]

Context

Codacy (Medium, cyclomatic complexity) on the moox/verapdf branch: SafeZipExtractor::assertEntryIsSafe() has cyclomatic complexity 11, over the threshold of 10. This is the zip-slip / symlink guard — security-sensitive, so the refactor must be strictly behavior-preserving.

What to build

The archive-entry safety check is decomposed into small, single-purpose checks so its complexity drops below the threshold, with identical behavior and no weakening of the guard.

Acceptance criteria

• assertEntryIsSafe() (or its replacements) has cyclomatic complexity ≤ 10.
• The distinct rejections — path traversal (..), absolute paths, entries resolving outside the target dir, and ZIP symlinks — are separated into focused helpers/guard clauses.
• Behavior is unchanged: every previously rejected entry is still rejected, every accepted one still accepted.
• Existing SafeZipExtractorTest cases stay green; add cases if any branch becomes newly exercised.

Blocked by

None — can start immediately.