scan zip members by infolist instead of name

[abdul-khaliq-khalid]

The zip branch of _extract_and_scan_archive walks zf.namelist() and reopens each member with zf.open(name), but zipfile resolves a name through NameToInfo, which only remembers the last entry carrying that name. So in an archive with two members called model.pkl the second one gets read twice and the first one is never scanned: a zip holding a malicious pickle first and a benign dict second comes back unsafe: 0, while that same pickle alone in a zip comes back unsafe: 3. Opening the ZipInfo objects from infolist() visits every member exactly once regardless of duplicate names, and utils.extract_zip_contents enumerates the same way so it gets the same treatment.