GHSA-8H9X-89F2-M7X3 Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

Summary The decompression-bomb bound added in 2.0.1 commit 1c1003c sums ZipArchive::statIndex$i'size' and rejects an archive whose declared uncompressed total exceeds system.gpm.archive.maxuncompressedsize default 1 GiB before extracting ZipArchiver.php:77-86; same logic in GPM\Installer::unZip a...