Validate tar and zip entries before extraction to prevent path traversal:
- Reject absolute paths in archives
- Reject .. traversal paths
- Reject symlinks pointing outside extraction dir
- New archive-entry-validator module with comprehensive tests
Addresses: security audit finding for unsafe archive extraction.
YeonGyu-Kim