zip source can introduce non-determinism

Summary

Along the same vein as #540 (closed) for the tar source, this needs some investigation.

If zip extractions can result in any different result based on the user's umask or whether BuildStream is being run as a super user, this needs to be addressed.

After investigation, if the file attributes are found to be exactly the same in all host environments, we can close this.