validate zip unix permissions at file creation

[valoq]

• Move the zip mode check into one helper used at both file creation and chmod
• A mode without unix file-type bits is treated as invalid and falls back to 0o644
• Fixes a gap left by fix: ignore invalid unix permissions and setuid bits from zip #1007, where file creation still applied the bogus mode
• Drop the redundant 0o777 mask already done by sanitize_archive_mode
• Add a test for a mode with no file-type bits falling back to the default
• Add a test confirming setuid, setgid, and sticky bits are stripped