Add native DumpIt ZDMP support

[joeyvictorino]

Summary

Adds native support for Comae/MAGNET DumpIt .zdmp compressed memory images by introducing a ZDMP translation layer that stacks ahead of the existing Windows crash-dump layer.

Implementation

• parses the 4096-byte ZDMP container header and chained ZBLK records
• supports LZNT1-compressed blocks and DumpIt raw-block fallback
• exposes the exact header-declared decompressed size, including short final blocks
• validates block CRC32 checksums lazily on read
• rejects truncated, oversized, zero-length, unsupported, and malformed blocks
• rejects compressed blocks that expand beyond the declared block size
• includes a pure-Python LZNT1 implementation with optional dissect.util acceleration
• adds a ZdmpStacker at stack order 10 so the existing Windows crash-dump stacker can operate on the decompressed stream

Validation

• 15 focused unit tests pass
• Ruff lint passes with the repository's exact configuration
• Ruff formatting check passes
• syntax compilation passes
• validated against a real 30.5 GB DumpIt .zdmp image
• windows.info succeeds directly against the .zdmp in approximately 3 seconds
• windows.pslist succeeds directly against the .zdmp in approximately 12 seconds and reports 437 processes
• decompressed output is MD5-identical to the reference converted .dmp
• CRC32 semantics verified across 300 real ZBLK records: 300/300 checksums matched the compressed payload and 0/300 matched the decompressed data

The focused tests cover raw blocks, compressed blocks, short final blocks, CRC failures, truncated payloads, zero-length and oversized blocks, oversized decompression output, unsupported data/compression formats, LZNT1 error handling, and stacker detection.

The real-image validation confirms the layer produces byte-identical output to the reference conversion path while allowing Volatility to analyze the .zdmp directly.

Closes #1325