deps: bump zip to 9.0.3 (all of 8.x is yanked)

[sanghnkim-max]

zip-rs has yanked every 8.x release, plus 9.0.0–9.0.2. zip = "8.6.0" therefore resolves only to yanked versions, and downstream crates fail cargo deny (error[yanked]) with no way to fix it from their side. The releases after 8.6.0 fix symlink-following during extraction, overflows in the implode decoder, and reads past an entry's declared size.

This changes Cargo.toml and fuzz/Cargo.toml to 9.0.3 and updates the lockfile. No code changes: anydoc only uses ZipWriter, SimpleFileOptions, ZipArchive::new/by_name and ZipError::FileNotFound, and none of those changed in 9. zip 9.0.3 keeps rust-version = 1.88.

cargo test --workspace (296 passed), cargo clippy --all-targets -- -D warnings and cargo fmt --check are all clean. A release on this would let us drop our vendored copy.

🤖 Generated with Claude Code

---

Summary by cubic

Bumps zip from 8.6.0 to 9.0.3 so downstream crates can pass cargo deny: all 8.x releases, plus 9.0.0–9.0.2, are yanked, leaving ^8.6.0 resolving only to yanked versions.

No code changes are needed — the used APIs (ZipWriter, SimpleFileOptions, ZipArchive::by_name) are unchanged in 9, and rust-version stays at 1.88. The bump also picks up fixes for symlink-following during extraction, decoder overflows, and reads past an entry's declared size.

^{Written for commit 3b829c6. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{View guided diff | Re-trigger cubic}

[tidusvn05]

Confirming this fixes things downstream. Every zip 8.x release is yanked, so projects that depend on anydoc now fail cargo deny / yanked-crate checks. For us that is okbot, through okbase-convert.

Checked on this branch (3b829c6):

• cargo test --locked passes (286 + 9 + 1 tests).
• With anydoc patched to this branch, okbot's knowledge crate builds and its tests pass on zip 9.0.3.
• zip 9.0.3 declares rust-version = 1.88, the same MSRV the Cargo.toml comment mentions.

A 0.2.5 release with this change would be much appreciated. Thanks!