Decompress a base64-encoded gzip payload. Returns the result as utf8 (text) or base64 (binary). Refuses to expand past 10MB to defend against zip bombs.