fix: prevent tar symlink traversal in archive extraction

Archives passed to git:from-archive and certs:add were extracted without symlink or path validation, allowing a crafted archive to write arbitrary files anywhere writable by the dokku user via symlink traversal. Extraction now pre-scans entries for absolute paths, parent traversal, and unsafe symlinks, applies the GNU tar `--no-unsafe-links` flag when available, and validates symlinks after extraction.

plugins/certs/subcommands/add

@@ -44,7 +44,7 @@ cmd-certs-set() {
     local CERTS_SET_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
     pushd "$CERTS_SET_TMP_WORK_DIR" &>/dev/null
     trap "popd &>/dev/null || true; rm -rf '$CERTS_SET_TMP_WORK_DIR' >/dev/null" RETURN
-    tar xvf - <&0
+    fn-archive-extract-tar-stdin "$CERTS_SET_TMP_WORK_DIR" "certs:add"
 
     local CRT_FILE_SEARCH=$(find . -not -path '*/\.*' -type f | grep ".crt$")
     local CRT_FILE_COUNT=$(printf "%s" "$CRT_FILE_SEARCH" | grep -c '^')