fix(updater): extracting the update zip drops symlinks and file permissions; the macOS in-app update can fail codesign #1765

Problem

`extractZipSecurely` (lib/core/updater/installers/update_install_utils.dart) writes every file entry with `File.writeAsBytes`. The macOS release zip is built with `ditto -c -k --keepParent`, so it holds the symlinks of the embedded frameworks (`Versions/Current`, `FlutterMacOS`, ...) and the permission bits. The `archive` package exposes both (`isSymbolicLink` / `symbolicLink`, `unixPermissions`), but nothing reads them.

Result of the extraction:

• every symlink becomes a regular file holding the link target as text;
• every executable loses its `+x` bit.

`MacosSparkleInstaller` then runs `codesign --verify --deep --strict` on that copy, which a flattened signed bundle is expected to fail ("Gatekeeper verification failed"). The permission loss is confirmed on a Mac. The generated replace script already patches one symptom with `chmod +x "$EXE"` for the main executable only; other helper binaries stay non-executable.

The codesign failure itself is inferred from the code, not observed yet.

Fix

In `extractZipSecurely`:

• create a `Link` for entries with `isSymbolicLink` (and reject targets that resolve outside the destination);
• apply `unixPermissions` to files (POSIX only);
• keep the existing size, ratio and traversal checks.

Add tests: an archive with a symlink and an executable entry round-trips; a symlink pointing outside the root is rejected. Once done, the `chmod +x` in `buildMacAppReplaceScript` can stay as a belt-and-braces step.

How to verify on a Mac

Update from a signed build through the app and check that it installs; before the fix, the log shows the verification error. The replace script logs to `~/Library/Logs/Querya/querya-update.log`.

Found in the system-functions review (see #1764).