feat: add bounded MSZIP cabinet extraction

tests/release-archive.test.ts

@@ -94,6 +94,9 @@ describe('release archive', () => {
     expect(
       createHash('sha256').update(files['LICENSES/lzxd-MIT.txt']!).digest('hex')
     ).toBe('c7a1dcbf839b1dfb72f24e1de12ab55f789db2c61d894ca9aa8b5f595490d9ca');
+    expect(
+      files['LICENSES/THIRD-PARTY-LICENSES.txt']!.toString('utf8')
+    ).toContain('fflate@0.8.3');
     expect(files).not.toHaveProperty(
       'tests/fixtures/joplin-test.onepkg.base64'
     );