[SECURITY] Avoid directory traversal on archive extraction

The Extension Manager and Language Pack Manager receive Zip archives as
input from foreign sources and extract them on the disk. However, the
previous approach is considered insecure as the target directory is not
checked per file and directory traversal was possible.

This patch adds a new service class that handles the extraction of Zip
archives via PHP's internal ZipArchive class, which can handle such
cases on its own.

Resolves: #88764
Releases: master, 9.5, 8.7
Security-Commit: a02f19c73211a5f1c0286ab44bee27da9b73f026
Security-Bulletin: TYPO3-CORE-SA-2019-024
Change-Id: I701a577f54410344867b868409a38cc44339f976
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62718


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>