everything: zip tool: add outputType to control resource vs. resource link output

[ochafik]

Follow up on https://github.com/modelcontextprotocol/servers/pull/2830

• Switch to gzip / single file so there's no extra deps
• Tool has default inputs to facilitate testing
• Add outputType input:
  • resource: blob
  • resourceLink: needs to be read by uri after the fact
• Added limitations:
  • fetch size limit = 10MB (overridable w/ GZIP_MAX_FETCH_SIZE)
  • fetch timeout (over all files) = 30sec (overridable w/ GZIP_MAX_FETCH_TIME_MILLIS env var)
  • only fetch http:, https: (restricted to domains listed in GZIP_ALLOWED_DOMAINS to mitigate SSRF attacks; defaults to just raw.githubusercontent.com) and data: URIs; no file:

cc/ @crondinini-ant

To test:

• Run gzip tool w/ a url as input (must be on raw.githubusercontent.com)

  

• If selecting resourceLink for outputType, the resource can then be read in the resources tab (hit List More Resources until reached last page)

  

[ochafik]

@cliffhall Added some file size limit + timeout to address @domdomegg 's comments on related pr.

Also simplified the resource handling / reusing the existing resource array.

[ochafik]

Thanks @cliffhall for testing & for the suggestion! (applied)

[cliffhall]

@ochafik seems like the package-lock.json has gotten out of sync. Can you resolve?

[cliffhall]

@ochafik I think this is a good change, would like to see it merged if you can just resolve conflicts.