Harden package archive extraction

[CAOShurong]

Outcome

Prevent downloaded package archives from writing outside willitbreak's cache destination, and prepare the patched 0.1.1 release.

Security change

• replace the string-prefix boundary check with exact path-component containment
• extract ZIP and tar members as regular files/directories instead of delegating to extractall
• reject links, devices, FIFOs, and other unsupported tar members
• add regression cases for same-prefix sibling traversal and special tar entries

Verification

• 92 unit tests pass, including the controlled archive traversal reproducer
• Ruff lint and format checks pass
• generated README check passes
• wheel and sdist build successfully and pass strict Twine validation
• the wheel installs cleanly in a fresh environment
• live checks retain exit code 2 for a real breaking urllib3 upgrade and 0 for a compatible requests upgrade

Release

Version is bumped to 0.1.1. After merge, the existing tag-triggered release workflow can publish the patched artifacts.