Bump rubyzip to support 3.x and widen addressable range

[cllde8]

Summary

This PR adds support for rubyzip 3.x and updates dependency constraints accordingly.

• Relax rubyzip runtime dep from ~> 2.0.0 to >= 2.3, < 4.
• Relax addressable runtime dep from >= 2.7, < 2.9 to >= 2.7, < 3.
• Verify gem test suite green.

Motivation

This PR enables compatibility with Rubyzip 3.x, which is required in newer Ruby/Rails environments. Current dependency constraints prevent upgrading without relaxing version bounds in downstream applications (e.g. when used alongside roo >= 2.4 and addressable 2.9.x).

Issue #30 tracks Rubyzip 3.0 support; this PR addresses that requirement.

Verification

• Full test suite executed, verified on:
  • Ruby 2.7.8 with rubyzip 2.4.1, addressable 2.9.0
  • Ruby 3.4.4 with rubyzip 3.3.0, addressable 2.9.0
• Manual ZIP round-trip test validated

Ruby compatibility

Rubyzip 3.x requires Ruby >= 2.7, therefore Ruby 2.6 is removed from the CI matrix.

[fbacall]

@cllde8, was there any particular reason for picking 2.3 as the minimum Rubyzip version?

[cllde8]

@cllde8, was there any particular reason for picking 2.3 as the minimum Rubyzip version?

Hi @fbacall

Yes. In rubyzip 2.0–2.2, only the positional Zip::File::CREATE flag is supported. Starting from 2.3, keyword arguments (create: true) are introduced while still maintaining backward compatibility with the positional form. In rubyzip 3.0, the positional form is removed and only create: true is supported. Therefore, 2.3 is the first version that provides overlap for both APIs.

Choosing >= 3 would also implicitly drop Ruby 2.7 support, since rubyzip 3 requires Ruby ≥ 3.0, as noted in the official upgrade guide: https://github.com/rubyzip/rubyzip/wiki/Updating-to-version-3.x.

Using >= 2.3, < 4 ensures compatibility with both rubyzip 2.x and 3.x while allowing a single, consistent keyword-based call site.