Malformed unused device fields are accepted

## Summary

`TarReader` accepts malformed `devmajor` and `devminor` fields even on an
ordinary regular member. The [reproduction archive](https://gist.githubusercontent.com/zaniebot/88e6b0a9b7e9376324cd3357098e5e40/raw/6399c074efaa58541a60291ef1e243ddc5981b63/TC-P03.tar) is rejected by
CPython `tarfile` and Go `archive/tar`; the other maintained peers accept it.

Tested at `1ac1199559a1b96f0f953ac99520ccc296503808`.

## Observed behavior

The two device fields contain `XXXXXXXX` and `YYYYYYYY`. Tar-codec treats them
as opaque and returns the regular member.

## Expected behavior

Consider validating populated device fields consistently, or document that
unused device fields are deliberately ignored for non-device members.

## Impact

This is an interoperability and validation-policy difference, not an extraction
vulnerability by itself.

Start with TarReader and the linked reproduction archive, then compare its handling of the malformed devmajor and devminor fields with CPython tarfile and Go archive/tar. Done means the project has a decided policy: consistently validate populated device fields or clearly document that these fields are ignored for regular members, with behavior aligned to that decision.

Written by the indexing model from the issue text.