Fix path traversal when extracting zip files

[uwezkhan]

This change prevents path traversal when extracting zip files in
download_and_unpack_zip.

Currently zip_file.extractall() is used without validating file paths,
which allows crafted archives with entries like ../../... or absolute
paths to write outside the target directory.

Added a small helper to validate paths before extraction and return
an error if an unsafe entry is found.

Also added tests to cover normal extraction, path traversal, and
absolute path cases.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.