Reject TAR links from untrusted archives

[M0nd0R]

Summary

• Reject symbolic-link and hard-link TAR members when extracting an untrusted archive.
• Preserve link extraction for callers that explicitly mark an archive trusted.
• Add regression tests for untrusted symbolic and hard links.

Root cause

The path-traversal guard checked a member name but did not examine the TAR member type. A safe-looking member name could therefore create a link whose target resolved outside the extraction directory.

Impact

This prevents untrusted archive consumers, including bundled testcase processing, from later following an extracted TAR link when reading a member path.

Closes #5364

Testing

• PYTHONPATH=src python3 focused unittest run for the two new TAR-link regressions (pass).
• The full archive test module was not runnable in this host environment because it uses Python 3.14 without the project Google dependencies; existing tests that emit error logs fail before reaching the assertions.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.