Normalize archive member names so bad directory entries are browsable - #336

Fixes #253

Some old distributions were built with archive member names that carry a leading /./ or ./ — medifile 2.1 from the issue is one, every member starts with ./. Those names can never be browsed: the listing links to the raw member name, URL handling removes the dot segments, and the file view then looks the cleaned-up path up by exact name, misses, and returns a 404. Every file in such a distribution is unreadable in inspector today.

This normalizes member names inside TarGzDistribution and ZipDistribution instead:

• A member's canonical name drops . and empty segments and resolves .. against the preceding segments, clamped at the archive root, so a listed name can never point outside the distribution.
• namelist() returns canonical names, and contents() applies the same normalization to the requested path before looking up the original member name. Files from broken distributions render like any other file; names that were already clean are unchanged (normalization is the identity for them).
• If two members normalize to the same name, the first in archive order wins.

On the options from the issue: I went with making the files linkable rather than showing a warning and hiding them, since the contents can be served safely — inspector only ever reads members in memory, nothing is extracted to disk. A warning banner could still be added later if knowing a distribution is malformed is useful on its own.

Tests: tests/test_distribution.py covers /./, ./, and mid-path . members for both tar and zip distributions, unchanged behavior for clean names, and .. members/requests staying inside the archive root. Verified against the real medifile 2.1 sdist: all 9 files returned 404 before, all 9 resolve after.