`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR
archive can create files **outside** the destination directory — a path traversal
(CWE-22).

In `src/dec.rs` (`Decoder::unpack`):

- A symlink entry's target is written without checking where it points
(`src/dec.rs:153`), so the archive can create a symlink that escapes the
destination directory.
- The out-of-destination containment check compares path **strings** only and does
not account for symlinks created earlier in the same unpack
(`src/dec.rs:176-181`), before reaching the write sinks
(`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at
`src/dec.rs:218`).
- The parser also accepts entry names containing `/` (`src/parser.rs:138-147`).

Combined, a malicious archive can include a symlink `a` pointing at an external
directory and then an entry named `a/b`, causing `b` to be written to
`<external>/b`, outside the destination. This can create new files anywhere the
process can write (it cannot overwrite existing files), which is escalatable to code
execution by planting files in attacker-chosen locations.