minizip: reject path-traversal and absolute-path archive entries

axis2_extract_currentfile() used the archive entry name (filename_inzip)
directly as the destination path for fopen(..., "wb") without validating it.
A crafted .aar/.zip entry with a "../" parent-directory component or an
absolute path (POSIX "/...", Windows "\..." or "C:...") therefore wrote
outside the extraction directory, allowing an attacker to overwrite existing
files - including a deployed service's shared library, yielding native code
execution when that service is next invoked (CWE-22/CWE-23/CWE-36).

Validate each entry name before opening it for writing and reject any
absolute path or standalone ".." component, halting extraction of the
offending archive.

Reported by Adithyan P.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>