Zipdownload: fix escaping in Mbox downloads

[gurnec]

Closes #10150.

This unfortunately adds some extra complication... a simpler alternative might be slurp each entire email into a variable and just preg_replace() it all at once in _download_messages(). That would add additional memory overhead though.

[alecpl]

I would prefer doing assertions after removing the file. The test files are small so we can keep them in memory.

[gurnec]

Do you mean something like:

1. extract filenames / file contents,
2. remove zip file (no try/finally block required),
3. do all assertions

probably all in checkFilesInZip()?

Also, just for future reference, would you prefer that I add new commits to this branch, or force-push existing commit(s) to keep the history a bit cleaner?

[alecpl]

1. extract filenames / file contents,
2. remove zip file (no try/finally block required),
3. do all assertions

probably all in checkFilesInZip()?

Yes, not necessarily in a single method.

Also, just for future reference, would you prefer that I add new commits to this branch, or force-push existing commit(s) to keep the history a bit cleaner?

Doesn't matter, I usually use the "Squash and merge" button.

[gurnec]

I've simplified the E2E tests w/o changing what is tested, should be better now.

[MiMoHo]

I did an independent review and test of this PR (AI-assisted, all results verified locally):

Functionality

• All 8 MboxFilterTest unit tests pass locally on PHP 8.5.8.
• Fuzz-tested the filter beyond the unit tests: 2,000 randomly generated documents built from adversarial tokens (From , >From, bare Fro/om , CRLF endings, > runs, …), written through the filter in random 16–64 byte chunks, and compared byte-for-byte against a whole-string reference implementation (preg_replace('/(?:^|(?<=\n))(>*From )/', '>\1', $data)) — zero mismatches, including From-lines split across bucket boundaries and the closing flush.
• Deterministic split cases verified as well: boundary between \r and \n, split inside From, split inside a > chain, split exactly after \n, first-line escaping, and an unterminated trailing >From at EOF — all correct.

The three failing CI checks are unrelated to this PR:

• Coding Style: the failure flags fully_qualified_strict_types in files this PR doesn't touch (installer/test.php, plugins/new_user_dialog/…, …) — a toolchain drift on master at the time of the run (2026-06-19); CI on master is green again since (e.g. the runs of 2026-07-04/05).
• Linux / PHP 8.4 (message rendering): transient network error pulling the docker image from ghcr.io (Client.Timeout exceeded while awaiting headers).
• Windows / PHP 8.1: transient composer download failure (file could not be written … Permission denied).

So a rebase onto current master (or re-running the checks) should turn CI green; functionally this looks ready from my side.