fix(security): sanitize archive extraction paths in RPA.Archive (zip slip)

[mikahanninen]

Summary

• Fixes a Zip Slip / path traversal vulnerability (CWE-22) in RPA.Archive.Extract Archive. Both the zipfile and tarfile extraction branches called extractall() without validating member paths, so a crafted archive with an entry like ../../evil.py could write files outside the requested destination directory.
• Adds _check_extraction_safety() which resolves each member's destination path and raises ValueError if it would escape the target directory, applied before extraction for both zip and tar archives (whole-archive and selected-members extraction).
• Adds regression tests (tests/python/test_archive.py) covering rejected zip/tar traversal archives and a normal extraction still working.
• Bumps rpaframework to 32.0.2 and updates release notes.

Fixes #1339, #1340.

Test plan

• uv run pytest tests/python/test_archive.py -vv — 3 passed (rejects zip slip, rejects tar slip, normal extraction still works)
• invoke code.test-robot -r archive — 19/19 existing Robot Framework tests still pass (no regression to normal extraction behavior)
• pylint clean on Archive.py

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Wheel artifact

Built from commit 3cdc647 — download from the workflow run (Artifacts section at the bottom of the page).

Artifact name: rpaframework-wheel (retained 14 days)