Add ZipStream factory for reading zip entries

[veewee]

Summary

• New ZipStream::read($archivePath, $entry, $zipOptions = []) factory for opening a single entry from a zip archive as a read-only ResourceStream.
• Pre-checks archive existence (typed ResourceStreamException). All other failures (missing entry, corrupt archive, wrong/missing password) surface as StreamActionFailureException carrying the underlying PHP message — via the existing SafeStreamAction, no @ suppression.
• Optional $zipOptions is passed straight under the zip key of stream_context_create(), so callers can supply e.g. ['password' => '...'] for encrypted entries.

The zip:// stream wrapper is read-only by design; write support would require ZipArchive and isn't part of this PR.

Test plan

• Missing archive → ResourceStreamException
• Happy path read
• Nested entry read
• Missing entry → StreamActionFailureException
• Encrypted entry with correct password
• Encrypted entry without password fails
• Full suite green (51 tests)