Also update unzLocateFile to the minizip-ng 4.0.4+ signature and document new unused files.

walking the zip prevents minizip from re-reading the same
data repeatedly from the actual backing filesystem.
also improves most usages of minizip to allow for >4GB,
files altho we probably don't need it

minizip-ng is the new name used by the upstream project as well as all
distros other than Fedora (but it looks like it will be renamed there).

SPDX standardizes how source code conveys its copyright and licensing
information. See https://spdx.github.io/spdx-spec/1-rationale/ . SPDX
tags are adopted in many large projects, including things like the Linux
kernel.

This allows the same code to be used to read into a std::string, which
allows for eliminating the vector->string transfer when reading the
manifest file.

A ContiguousContainer is a concept that includes std::array,
std::string, and std::vector.