`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

`SafeReleaseRepoActions::extract_release_archive` builds each output path from the **raw archive entry name** and writes to it with no traversal check, so a malicious release archive can create directories and write files **outside** the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23).

In `src/lib.rs` (`extract_release_archive`, zip branch):

```rust
let mut file = archive.by_index(i)?;
let out_path = dest_dir_path.join(file.name()); // file.name() is the raw entry name
if file.name().ends_with('/') {
std::fs::create_dir_all(&out_path)?; // no `..` check
} else {
let mut outfile = std::fs::File::create(&out_path)?; // writes outside dest
std::io::copy(&mut file, &mut outfile)?;
}
```

The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.