Fix path traversal vulnerability when extracting tar files

[heck-gd]

Followup to #96. This popped up during the internal review for the feature, but we forgot to upstream it.