CVE-2023-28105: Go-huge-util vulnerable to path traversal when unzipping files

The vulnerability stems from the unzipFile function's handling of zip entry names. The pre-patch code directly joined 'dstDir' and 'file.Name' (path.Join(dstDir, file.Name)), which could contain path traversal sequences. The fix introduced path sanitization via filepath.Join and strings.TrimPrefix to neutralize traversal attempts. Since the commit diff explicitly modifies this function to address the path traversal, and the CVE/GHSA both reference zip.Unzip (which calls unzipFile), this is the definitive vulnerable function.