Reject symbolic and hard links in untrusted TAR archives

TarArchiveReader validates the member pathname before extraction, but an untrusted TAR member can be a symbolic link or hard link whose target resolves outside the extraction directory.

This is unsafe for callers that later read extracted member paths as ordinary files, such as bundled testcase processing.

Reject TAR symbolic and hard-link members when trusted=False. Keep existing trusted-archive behavior unchanged, and add regression tests covering both unsafe link types.

Start by locating TarArchiveReader and its existing member-path validation, then find the archive regression tests. Trace how symbolic and hard-link members are handled when trusted=False and compare that with trusted-archive behavior. Done means both unsafe link types are rejected only for untrusted archives, with regression coverage for each while trusted behavior remains unchanged.

Written by the indexing model from the issue text.