[BUG] FPP3 loader can hang indefinitely and extracts tar archives without filtering

Describe the issue

_decompress_file_to_temp downloads an archive from CRAN using requests.get(...) without a timeout. A stalled connection can therefore block the dataset loader or CI indefinitely.

The downloaded tarball is subsequently passed to:

tar.extractall(path=temp_dir)

without an extraction filter or member-path validation. On Python versions where safe extraction is not the default, a malicious or compromised archive could write outside temp_dir through absolute paths or .. members.

Location

sktime/datasets/_fpp3_loaders.py, _decompress_file_to_temp

Current code

response = requests.get(url)
...
tar = tarfile.open(temp_file)
tar.extractall(path=temp_dir)

Expected behavior

• Set explicit connect/read timeouts on both download attempts.
• Extract using a safe filter where available.
• For supported Python versions without the appropriate safe default, validate every resolved member path remains within temp_dir.
• Use a context manager for the tar file.
• Clean up the temporary directory if either download or extraction fails.

Possible outline on Python versions supporting extraction filters:

response = requests.get(url, timeout=(10, 60))
response.raise_for_status()

with tarfile.open(temp_file) as tar:
    tar.extractall(path=temp_dir, filter="data")

Compatibility handling will be needed for older supported Python versions.

Suggested tests

• Mock requests.get and assert a timeout is supplied.
• Reject a tar member named ../../outside.
• Verify temporary files are cleaned up after failed extraction.