Replace unmaintained `decompress` with maintained fork `@xhmikosr/decompress` (CVE-2026-53486)

**Is your feature request related to a problem? Please describe.**

`@cubejs-backend/shared` and `@cubejs-backend/templates` depend on [`decompress@^4.2.1`](https://www.npmjs.com/package/decompress). That package is unmaintained — the latest release is 4.2.1 (2023) — and it is the subject of an unpatched security advisory:

- **GHSA-mp2f-45pm-3cg9 / CVE-2026-53486** — "Archive extraction can create files and links outside of the target directory" (path traversal via crafted hardlink/symlink entries; string-prefix containment check; setuid/setgid bits preserved). Affects all versions `<= 4.2.1`, i.e. every published release.

Because there is no fixed release of `decompress` itself, every downstream Cube.js user gets a permanently-open Critical Dependabot alert with no upstream remediation path. Consumers cannot cleanly override it themselves (see below).

**Describe the solution you'd like**

Migrate from `decompress` to the maintained fork **[`@xhmikosr/decompress`](https://www.npmjs.com/package/@xhmikosr/decompress)**, where the advisory is fixed in **10.2.1** and **11.1.3**. It is the actively-maintained successor from the same ecosystem that also maintains the related `decompress-*` plugins.

**Describe alternatives you've considered**

- Waiting for a fix in `decompress` upstream — not viable; it is unmaintained.
- Downstream `overrides`/`resolutions` aliasing `decompress` → `@xhmikosr/decompress` — not viable for CommonJS consumers, because the fork is ESM-only as of v10+ (`"type": "module"`, Node >=18/>=20), while `@cubejs-backend/shared` uses `require()`. This is precisely why the fix needs to happen in Cube.js.

**Additional context**

- Latest Cube (1.7.x) still pins `decompress ^4.2.1`.
- The ESM-only nature of the fork means this likely pairs with (or depends on) Cube.js's broader ESM migration.