Multiple improvements across storage SDKs: add try-with-resources for object streams and enforce a 100MB in-memory payload limit; make archive extraction use a configurable local_extract_path and clean up extraction directory after use. Fix zip slip vulnerability in FileUtil. Harden Blob by defensively copying payload and lastModified and add equals/hashCode; add equals/hashCode for DeleteTarget. AWS: apply S3 service configuration to presigner and detect content type using tika. Azure: decode source blob URL when copying and clarify client close behavior. GCP: switch to streaming upload/download channels, cache signing Storage when created from additional params, and add a warning when using inline service account JSON. OCI: initialize client more safely with cleanup on failure, read file bytes to compute MD5 and avoid raw FileInputStream streaming, and use Instant for expiry computation. Miscellaneous logging and minor robustness fixes.