Document how we safely handle CodeQL alert: Arbitrary file write during tarfile extraction

[blakeNaccarato]

Please use this form appropriately

• [X] I am a maintainer or I have been directed to use this form.

Please check that this internal matter hasn't already been raised

• [X] I searched here or here and couldn't find a similar issue.

Description

See for instance:

• https://github.com/softboiler/boilercine/security/code-scanning/1

We handle this safely by running the SHA-256 checksum before extracting, this should be documented in the template as it will fire off in repos using this template. Eventually, it may make sense to single-source this automatic Python installation script, or just wait for Charlie Marsh to do it over at uv 😅.