bazel-7: http_archive: java.io.IOException: Error extracting <compressed tarball>: Garbage after a valid .gz stream

### Description of the bug:

After upgrading from bazel 6.4.0 to 7.6.1, it seems like I can no longer decompress **_one_** of my http_archive tarballs (despite this working fine for bazel 6.4.0, and being to use `wget`+`tar` to fetch+unpack just fine).

```
ERROR: /data/ndesaulniers/CKT22237/.bazel/bazel/e5178882703a799d56ae48491a6f3efc-MyProject/external/bazel_tools/tools/build_defs/repo/http.bzl:136:45: An error occurred during the fetch of repository 'tinyxml':
Traceback (most recent call last):
File "/data/ndesaulniers/CKT22237/.bazel/bazel/e5178882703a799d56ae48491a6f3efc-MyProject/external/bazel_tools/tools/build_defs/repo/http.bzl", line 136, column 45, in _http_archive_impl
download_info = ctx.download_and_extract(
Error in download_and_extract: java.io.IOException: Error extracting /data/ndesaulniers/CKT22237/.bazel/bazel/e5178882703a799d56ae48491a6f3efc-MyProject/external/tinyxml/temp8022142404010996407/tinyxml.tar.gz to /data/ndesaulniers/CKT22237/.bazel/bazel/e5178882703a799d56ae48491a6f3efc-MyProject/external/tinyxml/temp8022142404010996407: Garbage after a valid .gz stream
```

### Which category does this issue belong to?

Core

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

_No response_

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 7.6.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

No

### Any other information, logs, or outputs that you want to share?

```
# WORKSPACE
http_archive(
name = "tinyxml",
build_file = "@//third_party/tinyxml:BUILD.bazel",
sha256 = "eb6016846fea55624eb5ee9e4612163c17b9e330c6ddad224f50b5a7b3f03a1b",
strip_prefix = "tinyxml",
url = "https:///tinyxml.tar.gz",
)
```

Start with tools/build_defs/repo/http.bzl at line 136 and the ctx.download_and_extract call used by the WORKSPACE http_archive for tinyxml. Reproduce on Linux with Bazel 7.6.1 using the supplied archive and compare against Bazel 6.4.0. Done means determining why the archive reports garbage after a valid .gz stream and confirming the behavior with a minimal reproducible case.

Written by the indexing model from the issue text.