Fixes a regression from [1e1f9982d](https://github.com/webmin/webmin/commit/1e1f9982d). That change put `--` in the wrong place for Zip, causing compression to fail.
Tar could still treat filenames as command options. This puts `--` in the correct place for both.
* Note: Validate File Manager action name/file parameters as checked paths under the current directory and `allowed_paths` before operations, blocking traversal and symlink escapes.
