feat: add bounded MSZIP cabinet extraction

THIRD_PARTY_NOTICES.md

@@ -4,6 +4,7 @@ The production application uses:
 
 - `@add-ideas/toolbox-contract` 0.1.1, Apache-2.0;
 - `@add-ideas/toolbox-shell-react` 0.1.1, Apache-2.0;
+- fflate 0.8.3, MIT;
 - React, React DOM, and Scheduler, MIT.
 
 The release packager collects the complete installed runtime licence texts into
@@ -22,6 +23,9 @@ adaptation of `lzxd` 0.2.5 (MIT OR Apache-2.0), pinned at
 option. Adapted modules carry provenance headers and the licence texts are in
 `LICENSES/rust-cab-MIT.txt` and `LICENSES/lzxd-MIT.txt`.
 
+MSZIP raw DEFLATE decoding uses fflate 0.8.3 (MIT). Its complete installed
+licence text is included in the generated runtime licence bundle.
+
 The Base64-encoded `onenote_desktop.one` test fixture comes from Joplin at
 commit `28eb53bd9f0cd4ae0dec0c59a08037075a38302b` and is distributed under
 AGPL-3.0-or-later. Its licence text is in `LICENSES/AGPL-3.0.txt`.