`zip` needs a lot more support

I'm https://github.com/Pr0methean, the lead maintainer of https://crates.io/crates/zip . Although that seemed like a feasible hobby project when I took it over in April 2024, it's becoming an increasingly ceaseless and thankless job.

I've had 27 security-advisory reports, 18 of which arrived so far this month, in addition to 15 invalid ones (mostly duplicates). Most of them turn out to break the CI in some way once they're merged, and there's no way to tell that until after they're merged because security fixes go on private forks that GitHub Actions refuses to run on. And the reports come at an irregular pace, every day or two: the last release I published without a known security issue was 9.0.0-pre3, and it turned out only not to have a *known* security issue because of a serious bug in GitHub's defaults about notifications for such reports!

Even when it's safe to publish security advisories the moment a fix is released and I do it, people don't update. The only partial exception was a few days ago when I yanked all the known-insecure versions -- which people only *then* saw fit to tell me wasn't the recommended practice, even though I'd done it after https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8 without much controversy and zero actual requests to stop doing so, and it'd been the published policy in https://github.com/zip-rs/zip2/blob/master/SECURITY.md ever since. Even then, 80% of downloads are still of the known-vulnerable versions!

Maintaining this crate has come at great cost to me. Not only has it forced me to pull all-nighters that a 38-year-old shouldn't have to pull, but it's prevented me from claiming my unemployment benefits by leaving me too little time to fulfill the 3-job-applications-per-week requirement that Washington State imposes. (Let alone actually translating into a job offer....)

Where do I ask for help, if it's not here? Are there any foundations out there that might be able to send me a full-time security coordinator, or at least arrange a one-time audit that would have a decent chance of finding all the vulnerabilities the code base actually has? Or at least buy us more GitHub Actions runners so that releases aren't pushed back quite as far when `cargo-afl` decides at the last minute that a `fuzz_write` test case is a "hang", for a PR at the head of the merge queue?