Move tar and zip extraction into a reusable package

/kind cleanup /priority P3

As shown in in the security advisory it's hard to reason about TAR extraction and more importantly: do the job securely.

Let's move the tar + zip extraction code out of pkg/downloader to its own package somewhere so we can use it in other projects.

It would be great to have some of the options to these methods configurable, this would also make tests easier, such as objects like TarGzExtractOptions and ZipExtractOptions with flags like:

• skip verifying secure paths (default: false)
• (for tarballs) skip pax header (default: true)
• ... what else?