Brekeke SIP Server: Unauthenticated RCE via Zip Slip Webshell

The unauthenticated ProvisioningModelImport bean decompresses an uploaded zip through a self-developed Zip.extractAll with no path-traversal filtering. A single POST writes a JSP webshell seven directories up into the webroot; a single GET triggers it — factory-default unauthenticated RCE as tomcat.