Add directory traversal for tar

[kpcyrd]

Original report at alexcrichton/tar-rs#238, discovered and reported by @mgjm.

Even though the report is from 2020 it still has 0day status, there's currently no patch. The stale issue was shared with me by @stoeckmann.

[tarcieri]

I asked about the advisory on the linked issue.

Would suggest giving a bit of time to hear back before merging this.

[kpcyrd]

Oops, I just noticed there's a placeholder here:

[affected]
functions = { "tar::Archive::unpack" = ["< 1.2.3"] }

It's the correct function but there's no patched version yet.