eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows

Summary

When extracting archives, `eazip` validates symlink entries before writing them. The validation function `validate_symlink()` (`src/utils/mod.rs`) scans for backslash and NUL bytes, but passes the symlink's *name* where the symlink's *target* was intended:

```rust memchr2(b'\\', b'\0', name.as_bytes()) // should be target.as_bytes() ```

As a result, symlink *targets* containing backslash or NUL bytes pass validation. On Windows, backslash is a path separator, so targets such as `..\..\..\Windows\system32\evil.exe` also defeat the remaining depth check, which splits on `/` only. A crafted archive can therefore create symlinks that resolve outside the extraction directory — including UNC targets such as `\\host\share\...` — redirecting writes to arbitrary filesystem locations chosen by the attacker.

Applications that extract untrusted archives with `eazip` on Windows targets are affected; on Unix targets backslash is not a separator, which limits exposure there.

The vulnerability was introduced in version 0.2.5 and fixed in 0.2.7 ([a1phyr/eazip@0e4caa13](https://github.com/a1phyr/eazip/commit/0e4caa13d59f5ba15aaac332f5534260c3b8fc43)), which rejects backslash and NUL bytes in the symlink target. It was privately reported to the maintainer on 2026-11-06 and credited in the 0.2.7 release notes.