Arbitrary file writes via unchecked extraction paths

Path traversal in zip-local before 0.3.5 allows attackers to write archive contents outside the intended extraction directory. ZipExport.extract_to joined each untrusted ZIP entry name to the destination without resolving and verifying that the resulting path remained beneath that destination. Any application that extracts an attacker-supplied archive can overwrite files writable by its process, with resulting effects determined by the targeted file.