feat(publish): relax skill upload constraints

[yun-zhi-ztl]

Changes

1. Size Limit Adjustments

• Single file size limit: 1MB → 10MB
• Total extracted package size limit: 10MB → 100MB

2. Expanded Allowed File Extensions

Added 21 common file types:

• Config: .toml .xml .ini .cfg .env
• Docs: .html .css .csv .pdf
• Images: .jpeg .gif .webp .ico
• Scripts/Languages: .rb .go .rs .java .kt .lua .sql .r .bat .ps1 .zsh .bash

3. Support Zip with Single Root Directory Wrapper

When a zip extracts to a single root directory (e.g. my-skill/), the wrapper directory is automatically stripped. The existing behavior (files directly at root) is preserved.

4. Other Improvements

• Refactored SkillPackageArchiveExtractor to inject SkillPublishProperties instead of using hardcoded constants
• Added magic byte validation for new image types (jpeg/gif/webp/ico/pdf)
• Extended secret scanning to cover newly added text file types
• Expanded determineContentType() MIME type mapping for new extensions

Tests

• SkillPackageValidatorTest: 14 tests passed
• SkillPackageArchiveExtractorTest: 7 tests passed
• BasicPrePublishValidatorTest: passed