Use a better tar filter than fully_trusted

[dholth]

Checklist

• I added a descriptive title
• I searched open requests and couldn't find a duplicate

What is the idea?

Python's relatively-new tar filter feature adjust permissions when extracting from tar. We have a comparable feature for earlier versions of Python that prevents "tar slip" or extracting files outside the root of a tar.

Use a more aggressive "tar" or "data" filter if we can be sure that no packages need the filtered permissions.