fix: prevent zip-slip in backup restore via canonical path validation

[PrivateBasicsApp]

The backup restore flow accepted relaxed layout filenames (matched against layouts/custom.+\..{0,4}) without validating the ZIP entry name against the target directory. This allowed path traversal in ZIP entry names, enabling zip-slip overwrites of arbitrary files under the app's files directory.
A malicious backup could exploit this to overwrite sensitive files such as libjni_latinime.so, which when combined with restored checksum preferences could lead to native code execution on the next keyboard load.

Changes
Added a safe extraction helper restoreEntryToDir(zip: ZipInputStream, baseDir: File, entryName: String): Boolean that:

Resolves both baseDir and the target file path canonically before writing
Rejects any entry whose canonical path falls outside baseDir
Logs and skips unsafe entries instead of writing them

Replaced direct File(baseDir, entryName) writes in the restore loop with calls to this helper.
Changes are localized to BackupRestorePreference.kt and preserve existing behavior for database and preferences entries.

[Helium314]

Thanks! How did you find this? Is there some bug that made you check the code?