Consider validation of LFH

[klausbrunner]

Right now the LFH content isn't validated at all - we just check if the CFH points to a location with the necessary LFH signature. This is deliberate as there seem to be many files in the wild with subtle discrepancies between the headers.

It could make sense to compare the CRC-32s between central and local headers, but need to be careful in the Data Descriptor case (e.g. CFH contains CRC-32, but LFH doesn't because it's in a Data Descriptor?).