context: cap TLS reads during zip import

[VrtxOmega]

- What I did

Applied the existing context-import decompressed read limit to TLS entries in zip context archives.

Fixes #6917

- How I did it

• wrapped zip tls/ entry reads with limitedReader, matching meta.json
• tightened limitedReader so it probes the underlying reader at the zero-remaining boundary and reports data beyond the limit
• added regressions for oversized compressed TLS entries and the exact limit-plus-one reader boundary

- How to verify it

GO111MODULE=auto GOPATH=<temp-gopath> go test github.com/docker/cli/cli/context/store -run 'TestImportZipRejectsOversizedTLSFile|TestLimitReaderReadAll' -count=1
GO111MODULE=auto GOPATH=<temp-gopath> go test github.com/docker/cli/cli/context/store -count=1
GO111MODULE=auto GOPATH=<temp-gopath> go test github.com/docker/cli/cli/context/store github.com/docker/cli/cli/command/context -count=1
git diff --check

- Human readable description for the release notes

`docker context import` now enforces the decompressed size limit for TLS material in zip archives.