[mhatipog]

Security fix scoped to src/xlsx-lite.js, src/file/metadata.js, and focused regression tests.

• Count emitted deflate bytes and abort early; enforce defaults of 1,024 entries, 16 MiB per entry, 64 MiB total actual output, and 200:1 ratio.
• Validate ZIP directory boundaries, local offsets and compressed lengths; reject forged declared sizes.
• Inspect only necessary Office XML parts; cleaning is bounded across every entry.
• Bound XLSX row/column/cell references (100,000 rows, 512 columns, 1 million cells).
• Preserve public APIs; optional lower limits enable tiny attack fixtures.

CI runs npm test.