Pull upstream changes

The old version of tar-rs (0.4.13) that this fork is based on has a known security bug that allows arbitrary files to be overwritten on the system by the tar unpacking function: https://rustsec.org/advisories/RUSTSEC-2018-0002.html

pkgutils and installer uses this crate, no idea how they are affected by this. (Couldn't test them in context because my Redox build is broken at the moment.)