CVE-2026-82049: resolve a hard link's target with os.path.realpath() in
tarfile.TarFile.makelink_with_filter() before calling os.link(), so a hard
link to an archived symlink is extracted as a copy of the file instead of a
duplicate symlink whose relative target escapes the destination directory