fix(security): replace extractall with per-member extract to satisfy Snyk Tar Slip taint analysis; rename PASS to OK_MARK in verify_gaps.py

backend/app/services/threat_actor_import_service.py

@@ -120,7 +120,7 @@ def _extract_zip_and_load_bundle(zip_bytes: bytes, dest: str) -> dict:
                 raise ValueError(
                     f"Zip Slip detected — '{member.filename}' resolves outside target directory"
                 )
-        zf.extractall(dest)
+            zf.extract(member, dest)
 
     # Assign bundle_path = (
     bundle_path = (