Fix: GHSA-9ppj-qmqm-q256

PR-URL: #455
Credit: @pieh
Close: #455
Reviewed-by: @isaacs

Fix a race in file extraction where a destination path could be swapped
to a symlink after the existing `lstat()` check but before the file was
opened.

This change uses `O_NOFOLLOW` for extracted file writes on non-Windows
platforms so the final open does not follow a symlink at the destination
path.

Also adds a regression test that reproduces the race and checks that
extraction does not overwrite a file outside the target directory.

PR-URL: #456
Credit: @Jvr2022
Close: #456
Reviewed-by: @isaacs