feat: add bounded MSZIP cabinet extraction

docs/SECURITY.md

@@ -57,6 +57,7 @@ The CAB/package path applies these defaults:
 | Total folder output             |        512 MiB |
 | Total extracted entry bytes     |        512 MiB |
 | Folder compression ratio        |          200:1 |
+| One MSZIP compressed block      |  32 KiB + 12 B |
 | LZX window                      |          8 MiB |
 | LZX decode operations           |  1,000,000,000 |
 
@@ -66,11 +67,13 @@ checksums, rejects overlapping/out-of-range data, rejects absolute/traversal,
 empty, control-character, and case-insensitive duplicate paths, and refuses
 multi-cabinet/spanning entries.
 
-LZX checks its window, Huffman trees, block sizes, match ranges, output size,
-and operation budget. CAB extraction checks cancellation and yields between
-data blocks so the worker can process termination. Desktop OneStore traversal
-checks fragment/reference cycles, nesting, object/property/reference counts,
-and byte ranges.
+MSZIP checks its `CK` framing and raw DEFLATE data, writes into a fixed caller
+buffer with one overflow-detection byte, requires the exact declared output
+size, and retains no more than 32 KiB of history. LZX checks its window, Huffman
+trees, block sizes, match ranges, output size, and operation budget. CAB
+extraction checks cancellation and yields between data blocks so the worker can
+process termination. Desktop OneStore traversal checks fragment/reference
+cycles, nesting, object/property/reference counts, and byte ranges.
 
 ## Rendering and links