.NET: Suppress false positive Zip Slip alert

[SergeyMenshykh]

Motivation & Context

Suppresses the false-positive CodeQL Zip Slip finding SM02729.

Description & Review Guide

• What are the major changes? Add an inline CodeQL suppression with justification.
• What is the impact of these changes? No runtime behavior changes.
• What do you want reviewers to focus on? The suppression justification.

Related Issue

N/A - internal CodeQL finding SM02729.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) - a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Adds a justified inline CodeQL suppression for a false-positive Zip Slip finding. Runtime behavior is unchanged.

Changes:

• Suppresses SM02729 where archive destinations are validated by ResolveDestination.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): ebb03924eda7
Model: gpt-5.6-sol

Overview

This PR adds only an inline CodeQL suppression and does not alter runtime behavior. The justification is supported by canonical path resolution, separator-aware containment checks, rejection before filesystem writes, and tests covering traversal and case-sensitive sibling escapes. No publishable issue was introduced by the change.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.