Fix unchecked Minizip extra-field lengths

[atharvmantri]

Fix unchecked Minizip extra-field lengths in zipRemoveExtraInfoBlock().

The function read a 16-bit extra-field length and used it for pointer advancement and memcpy() without checking it against the remaining caller-provided buffer. A malformed block could therefore cause an out-of-bounds read/write. This change:

• validates that each block has a complete four-byte header;
• validates the declared block length against the remaining input;
• uses an unsigned 16-bit length for the ZIP field;
• returns ZIP_PARAMERROR before modifying the caller's buffer when validation fails; and
• handles allocation failure.

This addresses #1276.

Validation performed on Windows with native MinGW/CMake:

• cmake --build build-pr1314-mingw --parallel 2 passed, including the Minizip library, CLI targets, and the new regression test.
• CTest passed all 30/30 configured tests, including the new malformed-extra-field bounds test and the existing Minizip path tests.
• git diff --check passes.

The regression test checks both truncated headers and declared lengths that exceed the remaining buffer, verifies ZIP_PARAMERROR, confirms the caller buffer and length remain unchanged on rejection, and confirms a valid block is still removed. Local build directories are evidence only and are not part of the source change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.