Add a ZipScanner, which scans zip files without extraction

This won't support any checks that assume the path lives on a
real filesystem, e.g. phpcs & clamav

/cc @mjangda
Might be cleaner to use getFromName in ZipArchive instead of file_get_contents.