Guard tar extraction against path traversal in model download

[abhiprd2000]

While fixing #1163 I read through the rest of the download path and noticed the
tar extraction at line 8554 calls tarfile.extractall() with no filter=.

zipfile strips .. automatically and the two zip sites here (5449, 10792) get
that for free. tarfile never has. A member named ../evil.txt writes one
directory above the target, silently, without raising.

safe_extract_tar() uses filter="data" where available, else vets members with
realpath containment checks. Detection is hasattr(tarfile, "data_filter"), not
a version check . filter= was backported to 3.11.4 and requires-python ">=3.11" still admits 3.11.0–3.11.3, where passing it raises TypeError.

Tests cover the helper and the wiring.

Not verified whether Kaggle sanitizes member names server-side. Happy to drop the fallback and require

= 3.11.4 instead. It guards four superseded releases and has a TOCTOU gap that
filter="data" doesn't. Hope that helps!

[stevemessick]

/gcbrun

[stevemessick]

Thanks!