Deduplicate unsafe ZIP entry rejection in SafeZipExtractor

Extract reject(): never helper so the shared throw message lives in one
place after the assertEntryIsSafe complexity refactor.

Refs mooxphp/verapdf#7

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jbagsik

packages/verapdf/src/Support/SafeZipExtractor.php

@@ -51,7 +51,7 @@ public static function extract(string $zipPath, string $targetDir): void
     private static function assertEntryIsSafe(ZipArchive $zip, int $index, string $entryName, string $targetDir): void
     {
         if (self::isSymlinkEntry($zip, $index)) {
-            throw new RuntimeException("Refusing to extract unsafe ZIP entry: {$entryName}");
+            self::reject($entryName);
         }
 
         $normalized = str_replace('\\', '/', $entryName);
@@ -64,15 +64,15 @@ private static function assertEntryIsSafe(ZipArchive $zip, int $index, string $e
     private static function assertPathIsRelative(string $entryName, string $normalized): void
     {
         if ($normalized === '' || str_starts_with($normalized, '/') || preg_match('#^[A-Za-z]:/#', $normalized) === 1) {
-            throw new RuntimeException("Refusing to extract unsafe ZIP entry: {$entryName}");
+            self::reject($entryName);
         }
     }
 
     private static function assertPathHasNoUnsafeSegments(string $entryName, string $normalized): void
     {
         foreach (explode('/', rtrim($normalized, '/')) as $segment) {
             if ($segment === '' || $segment === '.' || $segment === '..') {
-                throw new RuntimeException("Refusing to extract unsafe ZIP entry: {$entryName}");
+                self::reject($entryName);
             }
         }
     }
@@ -83,10 +83,18 @@ private static function assertPathStaysUnderTarget(string $entryName, string $no
         $destination = $targetRoot.'/'.ltrim($normalized, '/');
 
         if ($destination !== $targetRoot && ! str_starts_with($destination, $targetRoot.'/')) {
-            throw new RuntimeException("Refusing to extract unsafe ZIP entry: {$entryName}");
+            self::reject($entryName);
         }
     }
 
+    /**
+     * @throws RuntimeException
+     */
+    private static function reject(string $entryName): never
+    {
+        throw new RuntimeException("Refusing to extract unsafe ZIP entry: {$entryName}");
+    }
+
     private static function isSymlinkEntry(ZipArchive $zip, int $index): bool
     {
         $opsys = 0;