[Bug]: Referencing `tar` directly allows for System32 shadowing on Windows.

### What happened?

When using `npm_import` it seems that on Windows, if you have a dependency that is a `.tar.bz2`, it will hang forever trying to extract it.

Basically the main issue is that this is impossible to fix without doing `cp $(which tar) .` or somehow putting the tar executable in a place where System32 can't shadow it. Locally I edited [this line](https://github.com/aspect-build/rules_js/blob/92a36f314b7841475e12a68dcd018c088f373bc2/npm/private/npm_import.bzl#L466) to use `rctx.execute([rctx.which("tar"), ...])` and it works. Though I suspect ya'll may want to use some hermetic method of accessing `tar` instead.

### Version

Development (host) and target OS/architectures: Windows 10 and Windows 2022 (Github CI runner)

Output of `bazel --version`:
bazel 6.2.1

Version of the Aspect rules, or other relevant rules from your
`WORKSPACE` or `MODULE.bazel` file:
http_archive(
name = "aspect_rules_js",
sha256 = "71895e99936ab4cdb2c2ed6f076134cf5799c478c33ae3fa934f279b585a9b38",
strip_prefix = "rules_js-1.29.0",
url = "https://github.com/aspect-build/rules_js/releases/download/v1.29.0/rules_js-v1.29.0.tar.gz",
)

Language(s) and/or frameworks involved:
Javascript

### How to reproduce

npm_import any `.tar.bz2` on Windows.

### Any other information?

I suspect these binaries may be dropped in System32 when WSL installed, but I don't know that to be the case for certain.

Start at npm/private/npm_import.bzl around line 466, where the tar extraction command is assembled. Reproduce npm_import with a .tar.bz2 dependency on Windows and verify that extraction completes without System32 shadowing the intended tar executable.

Written by the indexing model from the issue text.