LyingZip builds a ZIP of one deflated member, payload.bin, holding size
zero bytes while its local and central headers both say it holds 100: the
shape of a decompression bomb that lies about its size. Readers that trust
the declared size must stop at 100 bytes.