Preventing ZIP parser confusion attacks on Python package installers

The Python Package Index is introducing new restrictions to protect Python package installers and inspectors from confusion attacks arising from ZIP parser implementations. This has been done in response to the discovery that the popular installer uv has a different extraction behavior to many Python-based installers that use the ZIP parser implementation provided by the zipfile standard library module. Summary ZIP archives constructed to exploit ZIP confusion attacks are now rejected by PyPI.