Sanitize archive entry paths before writing to disk
Tar extraction must normalize `header.Name` with `filepath.Base` or `filepath.Clean` before opening destination files.
#Metadata
#Why it matters
Writing `hdr.Name` directly enables `../` traversal that escapes intended extraction directories.
#Remediation
Join destinations using a fixed root with `filepath.Join`, reject absolute paths, and always apply `filepath.Base` before `os.Create`.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/go/go.security.tar-path-traversal.rule.yaml.