…2_t'

Replace raw ${FOO_LIBRARIES} / ${FOO_LIBRARY_DIRS} / ${FOO_INCLUDE_DIRS}
appends with imported target references so installed targets files don't
bake build-machine paths into INTERFACE_LINK_LIBRARIES. Affects ZLIB-NG,
ZLIB, BZip2, LibLZMA, ZSTD, OpenSSL, Iconv, and libbsd. Drops the
pkg-config-first paths for LZMA/ZSTD/OpenSSL since find_package now
provides portable imported targets across CMake 3.14+.

Refs #914.

find_library returns SDK-absolute paths like
/Applications/Xcode.app/.../MacOSX.sdk/System/Library/Frameworks/CoreFoundation.framework
which get baked into INTERFACE_LINK_LIBRARIES on install and break
downstream consumers whose SDK lives at a different path. Pass the
frameworks as plain "-framework Foo" linker flags so each consumer's
own toolchain resolves them.

Refs #914.

Backend libraries (zlib, bzip2, lzma, zstd, openssl, iconv, frameworks)
are implementation details that don't appear in mz.h's public API, so
their linkage is PRIVATE rather than PUBLIC. For static minizip CMake
still propagates them transitively via INTERFACE_LINK_LIBRARIES_PRIVATE
when needed; for shared minizip they stay encapsulated and don't pollute
consumer link lines.

The target_link_directories call is no longer needed because every
imported target carries its own library directory; MINIZIP_LBD is
removed along with it.

Refs #914.

The list drives find_dependency() calls in the generated minizip-config.cmake,
so registering a package whose CMake config doesn't exist on the consumer
machine (PPMD, fetched BZip2/LibLZMA/zstd, etc.) makes find_package(minizip)
fail at configure time. Only register a package when it was located via
find_package, not when built from a fetched source tree (those targets are
already carried forward through install(EXPORT)).

Add Threads to MINIZIP_DEP_PKG when liblzma is fetched, since upstream xz's
exported target lists Threads::Threads in its INTERFACE_LINK_LIBRARIES and
the consumer's config has to recreate that imported target.

Refs #914.

compat/zip.h and compat/unzip.h reference zlib types and macros (ZEXPORT,
Z_DEFLATED, ...), so any consumer including those headers needs zlib's
INTERFACE_INCLUDE_DIRECTORIES on its include path. Linking via the imported
target keeps the install portable: find_dependency(ZLIB) on the consumer
recreates the target with the consumer's local paths, not the build host's.

Other backends are pure implementation details and stay PRIVATE.

Refs #914.

Hard-coding "-lssl -lcrypto" in Libs.private breaks for LibreSSL (different
library names), MSVC import libraries, and custom build suffixes. Reference
openssl in Requires.private instead so the consumer's pkg-config delegates
to openssl.pc and resolves the correct library names locally.

Caught in PR review on #983.

find_package(ZLIB-NG QUIET CONFIG) reads zlib-ng's installed
zlib-ng-config.cmake and the matching zlib-ng-targets-<config>.cmake
files, so the bundled MODULE-mode finder is no longer consulted. The
upstream config knows the correct library names per build configuration
(including the -ngd debug suffix on MSVC), which the bundled finder
didn't.

Fixes #952.

A shared minizip encapsulates its PRIVATE backend deps (bzip2, lzma, zstd,
iconv, ...) inside the .so/.dylib, and minizip-targets.cmake doesn't
reference them. Emitting find_dependency() for those backends in the
generated package config forces consumers of shared minizip to install
every backend just to call find_package(minizip), even when nothing
needs them.

Split MINIZIP_DEP_PKG into a PUBLIC list (always required, e.g. ZLIB
under MZ_COMPAT) and a private list emitted only when minizip is built
static. The static archive still requires all of them transitively.

Fixes #898.

mz_dir_has_unsafe_symlink walks every component of the destination
path and rejects any symlink with an absolute target. That's too
strict: when the user-chosen destination dir (or one of its ancestors)
happens to be a symlink, extracting into it gets rejected with -107.
The check only needs to police symlinks that appear strictly inside
the destination, since those could be zip-controlled.

Skip the symlink check when check_path is at or above base_path; let
the existing logic enforce on components below.

Fixes #943.

The Apple crypto backend defaults MZ_TARGET_APPSTORE to 1, which
makes mz_crypt_aes_set_key return MZ_SUPPORT_ERROR for GCM mode
because the GCM CommonCrypto APIs are private and rejected by App
Store review. The test was hard-coded to expect MZ_OK and failed on
the default macOS build.

Skip the test when the runtime reports MZ_SUPPORT_ERROR; otherwise
proceed and verify correctness as before.

minizip_erase rewrites the archive to a temp file under TMPDIR and
then renames it onto the source. rename(2) returns EXDEV across
filesystems, so when TMPDIR (e.g. /tmp) and the source live on
different mounts (a common conda-forge pattern), the rename fails
after the original was already moved aside to .bak — the next
operation that opens the archive sees no file and reports -111.

Add mz_os_path_same_fs() and have minizip_erase fall back on POSIX to
a same-dir temp when TMPDIR is on a different filesystem. POSIX uses
stat() st_dev comparison; Win32 uses _wstati64 for the parallel check
but the caller skips it under #ifndef _WIN32 because MoveFileExW with
MOVEFILE_COPY_ALLOWED already absorbs cross-volume rename internally.

Make the same-dir tmp filename unique (mz_ms_time suffix) and refuse
to clobber an existing leftover from a prior crash.

Refs #943.

mz_os_get_file_attribs used lstat on POSIX and GetFileAttributesW
on Win32, both of which return the link's own attributes rather
than the target's. Callers that wanted to follow a symlink had no
way to ask for that, so mz_zip_writer_add_file produced followed
entries tagged ISLNK and readers that tried to recreate them as
symlinks.

Flip mz_os_get_file_attribs to stat on POSIX and to a CreateFile +
GetFileInformationByHandle path on Win32 when the entry is a
reparse point. Add mz_os_get_link_attribs preserving the original
lstat / GetFileAttributesW semantics. Update mz_zip_writer_add_file
to pick the right getter for each branch and to skip symlinks
cleanly when neither store_links nor follow_links is set.

Refs #797.

Returns the absolute offset where the current entry's compressed
data begins, matching the original minizip API used by chromium and
other consumers. The position is already tracked internally via
entry_pos for STORE-method seek support, so this just exposes it.

Both packages export separate static and shared imported targets, but
the find_package paths picked one variant unconditionally — zstd
preferred libzstd_static and zlib-ng always linked the shared zlib.
Building minizip-ng with BUILD_SHARED_LIBS=ON against a system zstd
that ships both variants therefore produced a libminizip.so with zstd
statically baked in (#983).