Add ability to track scans of newly-extracted nested tarballs etc.

I'm not entirely clear on what we can currently do, but it would be helpful to be able to update scan results as we get further into an audit and find the need to extract and scan codebase archives that the initial `--shallow` scan did not reach.