feat: cannot extract files outside the target directory

[letFunny]

• Have you signed the CLA?

---

This commits adds several security controls and tests so that files
cannot be extracted outside of the target directory, and hardlinks
cannot point to files outside of the target directory.

[github-actions]

Command	Mean [s]	Min [s]	Max [s]	Relative
BASE	7.496 ± 0.033	7.448	7.543	1.00
HEAD	7.810 ± 0.037	7.752	7.871	1.04 ± 0.01