CVE-2026-63436: zt-zip: Path traversal in fluent API unpack

ZipUtil.unpack(...) rejects ZIP entries that escape the target output directory, but the Zips fluent API appears to use a separate unpack implementation that does not apply the same destination-boundary check.

A ZIP entry such as:

../escape/poc.txt

is written outside the configured destination directory when processed with:

Zips.get(zip).unpack().destination(outputDir).process();

The transformer branch is affected as well.