ext/zip: fix use-after-free in the archive destructor path

[jvoisin]

Commit 132403d guarded php_zipobj_close() and ZipArchive::open() with the archive->close flag so that a progress or cancel callback firing during zip_close() cannot re-enter and run a nested zip_close() followed by zip_discard(), which frees the archive still in use.

php_zip_archive_release() was left unguarded. php_zipobj_close() sets archive->za = NULL before calling release(), so the close() path is safe, but when a ZipArchive is destroyed without an explicit close() the archive is finalized here with za still set. The progress/cancel callback fires during that zip_close(), and a re-entrant close() or open() then nests zip_close() on the same archive, causing the same use-after-free.

Set archive->close around the release-path zip_close() as well, so the re-entrant call throws "Already being closed" instead of nesting.

[devnexen]

suggestion (does not have to be in the same PR, but since the goal is to "plug" cases where the zip stream close):

• protecting the getStream() case that can still reach the assert (I think adding php_zipobj_closing check is enough).
• guarding php_zip_progress_callback_free like php_zip_progress_callback does ?

Other than that, the fix itself here is correct from my POV.