Add a ZipScanner, which scans zip files without extraction

This won't support any checks that assume the path lives on a
real filesystem, e.g. phpcs & clamav

/cc @mjangda