What a decompression bomb is (and how this tool defends against it)

Because a domain's rua= address is published in public DNS, anyone — not just legitimate mail receivers — can send it an attachment. A hostile actor could craft a small gzip/zip file that expands to gigabytes when decompressed, exhausting memory or disk. This tool inflates gzip data through a bounded stream in small chunks, checking the size after every chunk so a bomb is caught mid-stream rather than after the damage is already done, and caps both the count and per-entry size of zip archive entries before or while reading them.