False positive: go/zipslip when `filepath.IsLocal` is already used

go/zipslip was detected, but the case was already protected by `filepath.IsLocal`.

Code example:

```go
r := tar.NewReader(bytes.NewReader(data))
for {
hdr, err := r.Next()
if err != nil {
if errors.Is(err, io.EOF) {
break // End of archive.
}
return fmt.Errorf("failed to read next tar entry: %v", err)
}
name := hdr.Name
if !filepath.IsLocal(name) {
continue
}
if hdr.FileInfo().IsDir() {
continue
}
// ... Make files/dirs based on name.
```

https://github.com/microsoft/go-infra/blob/7d114900fe9286d0fa400d02c6c5034b439d955b/gitcmd/gitcmd.go#L89-L125

https://github.com/microsoft/go-infra/security/code-scanning/4

> [IsLocal](https://pkg.go.dev/path/filepath#IsLocal) (added in go1.20) reports whether path, using lexical analysis only, has all of these properties:
>
> * is within the subtree rooted at the directory in which path is evaluated
> * is not an absolute path
> * is not empty
> * on Windows, is not a reserved name such as "NUL"
>
> If IsLocal(path) returns true, then Join(base, path) will always produce a path contained within base and Clean(path) will always produce an unrooted path with no ".." path elements.
>
> IsLocal is a purely lexical operation. In particular, it does not account for the effect of any symbolic links that may exist in the filesystem.

https://pkg.go.dev/archive/tar#Reader.Next mentions `IsLocal` as the way Go may automatically prevent zipslip:

> If Next encounters a non-local name (as defined by [filepath.IsLocal](https://pkg.go.dev/path/filepath#IsLocal)) and the GODEBUG environment variable contains `tarinsecurepath=0`, Next returns the header with an [ErrInsecurePath](https://pkg.go.dev/archive/tar#ErrInsecurePath) error. A future version of Go may introduce this behavior by default. Programs that want to accept non-local names can ignore the [ErrInsecurePath](https://pkg.go.dev/archive/tar#ErrInsecurePath) error and use the returned header.

---

I found an existing issue about go/zipslip, but it's about looking inside a func, not `IsLocal`:

* https://github.com/github/codeql/issues/17573