PR 3655 regression fixes (#3664)

* chore: undo unintended updater `zip` feature drop, tweak comment

* fix: correct unintended regression on version and project validation

This was caused by a mistake when coalescing mostly copied and pasted
`RE_URL_SAFE` regexes into one.

Cargo.lock

@@ -4387,7 +4387,7 @@ dependencies = [
  "webp",
  "woothee",
  "yaserde",
- "zip",
+ "zip 3.0.0",
  "zxcvbn",
 ]
 
@@ -8704,6 +8704,7 @@ dependencies = [
  "tokio",
  "url",
  "windows-sys 0.59.0",
+ "zip 2.4.2",
 ]
 
 [[package]]
@@ -8907,7 +8908,7 @@ dependencies = [
  "uuid 1.16.0",
  "whoami",
  "winreg 0.55.0",
- "zip",
+ "zip 3.0.0",
 ]
 
 [[package]]
@@ -11029,6 +11030,21 @@ dependencies = [
  "syn 2.0.101",
 ]
 
+[[package]]
+name = "zip"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "indexmap 2.9.0",
+ "memchr",
+ "thiserror 2.0.12",
+]
+
 [[package]]
 name = "zip"
 version = "3.0.0"