Fix silent archive-extraction overwrites from APFS path collisions on macOS

[tomasilluminati]

Description

On macOS the archive decompressors compare entry names as raw bytes, but APFS folds names through Unicode normalization (NFC/NFD) and, on case-insensitive volumes, case folding. Two byte-distinct entries can therefore hit the same inode, and the second silently overwrites the first: for example pkg/ss_output.txt and pkg/ß_output.txt under strip_prefix "pkg", or SECRET.env next to secret.env. Both still land inside the destination, so this is a name collision (CWE-706, CWE-176), not a directory escape.

I add HostPathCollisionChecker. Per extraction it records each written target in the host's equivalence form and throws if a byte-distinct entry resolves to one already written. It is wired into CompressedTarFunction, ZipDecompressor, SevenZDecompressor and ArFunction; identical bytes keep the current last-writer-wins behavior. Folding is canonical NFC plus case folding, not NFKC, which over-folds compatibility forms that APFS keeps distinct. Off macOS it is a no-op, so Linux and Windows are unchanged. -Dbazel.darwin.case_sensitive=true drops the case-fold step for case-sensitive volumes.

Motivation

A silent overwrite during extraction is a data integrity bug: an archive can carry two files a Linux build sees as separate, and on a Mac one clobbers the other with no warning. This turns the collision into a hard error instead.

Build API Changes

No

Checklist

• I have added tests for the new use cases (if any).
• I have updated the documentation (if applicable).

Release Notes

RELNOTES: On macOS, archive extraction now errors when two byte-distinct entries resolve to the same path under APFS normalization or case folding, instead of silently overwriting.