CVE-2007-4559: backport the PEP 706 tarfile extraction filters (filter=
argument, fully_trusted/tar/data filters, TarFile.extraction_filter). Opt-in:
the default is unchanged and remains vulnerable; pass filter='data' to block
the directory traversal.