`main-is: ..` causes source-repository-package and sdist to make invalid tar

**Describe the bug**
Can't use package with `..` in main-is as source-repository-package, even if `sdist` and `check` succeed.

**To Reproduce**
Steps to reproduce the behavior:

```
% cd dotdot-cabal-repro
% cabal init
% echo "packages: .\nsource-repository-package\n type:git\n location: git@github.com:yesodweb/wai.git\n tag: ac529c60\n subdir: wai-app-static" > cabal.project
% echo " build-depends: wai-app-static" >> dotdot-cabal-repro.cabal
% cabal run
Resolving dependencies...
Build profile: -w ghc-9.0.2 -O1
In order, the following will be built (use -v for more details):
- wai-app-static-3.1.7.2 (lib) (requires build)
- dotdot-cabal-repro-0.1.0.0 (exe:dotdot-cabal-repro) (configuration changed)
cabal: Failed to unpack wai-app-static-3.1.7.2 (which is required by
exe:dotdot-cabal-repro from dotdot-cabal-repro-0.1.0.0). The exception was:
Invalid file name in tar archive: "wai-app-static-3.1.7.2/test/../"

% cabal --version
cabal-install version 3.6.2.0
compiled using version 3.6.2.0 of the Cabal library
```

**Expected behavior**
I expected the package to be usable since it works as an sdist.

**System information**
- Operating system: Debian 11 (bulleye)
- ghc-9.2.1