Adam/fix tar symlink

[adamhathcock]

fixes GHSA-rch7-vc9j-fw2v

This pull request introduces significant improvements to the security of directory extraction, specifically around symbolic links and reparse points. It ensures that symbolic links cannot target locations outside the extraction root and that extraction never follows symbolic links or reparse points in later entries. The changes also add comprehensive tests to verify these protections across multiple extraction APIs.

Security enhancements for extraction:

• Extraction now rejects symbolic link targets that point outside the extraction root, and never follows symbolic links or reparse points when extracting subsequent entries. This prevents directory traversal and privilege escalation attacks. (src/SharpCompress/Common/DirectoryManagement.cs, src/SharpCompress/Common/IEntryExtensions.cs, src/SharpCompress/Common/IEntryExtensions.Async.cs, [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

• New error messages and validation methods were added to enforce these checks and throw exceptions if a violation is detected. (src/SharpCompress/Common/DirectoryManagement.cs, [1] [2]

API and documentation updates:

• The SymbolicLinkHandler documentation and interface were updated to clarify the new security guarantees and behaviors. (src/SharpCompress/Common/ExtractionOptions.cs, src/SharpCompress/Common/Options/IExtractionOptions.cs, [1] [2]
• The public API documentation was updated to describe the new symbolic link extraction restrictions. (docs/API.md, docs/API.mdR466-R467)

Testing:

• Added comprehensive tests for symbolic link extraction, covering cases where the link target is outside the extraction directory and where entries beneath a symbolic link are present. These tests ensure that the handler is not called and no files are written outside the extraction root, across both sync and async APIs. (tests/SharpCompress.Test/Security/SymbolicLinkExtractionTests.cs, tests/SharpCompress.Test/Security/SymbolicLinkExtractionTests.csR1-R304)

Overall, these changes greatly improve the safety of extracting archives containing symbolic links, providing robust defenses against common archive extraction vulnerabilities.