Python: Add modelling for zstd.compression

[tausbn]

See https://docs.python.org/3/library/compression.zstd.html for information about this library.

As far as I can tell, the zstd library is not vulnerable to things like ZipSlip, but it could be vulnerable to a decompression bomb attack, so I extended those models accordingly.

[Copilot]

Pull request overview

This PR adds modeling support for Python 3.14's new compression.zstd library to detect potential decompression bomb vulnerabilities. The implementation follows the established pattern used for other compression libraries like gzip, bz2, and lzma.

• Extends the decompression bomb detection to include zstd.open() and zstd.ZstdFile() calls when used in read mode
• Adds test cases to verify the new detection capability
• Updates auto-generated expected test results

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
python/ql/test/experimental/query-tests/Security/CWE-409/test.py	Adds test cases for zstd.open() and zstd.ZstdFile() decompression bomb vulnerabilities
python/ql/test/experimental/query-tests/Security/CWE-409/DecompressionBombs.expected	Updates auto-generated expected test results with new test case line numbers
python/ql/src/experimental/semmle/python/security/DecompressionBomb.qll	Implements the Zstd module with decompression sink detection logic for Python 3.14+
python/ql/lib/change-notes/2025-12-09-add-modelling-of-zstd-compression.md	Documents the addition of compression.zstd library support

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yoff]

One variable name looks off. Nice approach with making space for the test, seems easy to implement. If the PR diff display were better at highlighting changes characters (more than changed lines), it would be super easy to verify that only line numbers changed.

[yoff]

LGTM