fix(npm): validate tar paths before extraction (#36468)
## Summary
- normalize npm tar entry paths before creating parent directories
- reject entries whose normalized destination does not remain within the
extraction output
- retain valid nested paths and GNU/PAX extended names
## Background
The extraction code previously created an entry's parent directory
before normalizing the path and checking that it remained within the
output directory. Malformed archive paths could therefore leave
unexpected directories behind even though extraction returned an error.
This moves component-aware path resolution ahead of all entry-specific
filesystem work. It also rejects absolute and platform-prefixed
destinations while preserving nested paths that normalize within the
output directory.
## Tests
- `./tools/format.js --check`
- `cargo test -p deno_npm_cache --lib`
- `cargo check -p deno_npm_cache --all-targets`
- `cargo clippy -p deno_npm_cache --tests -- -D warnings`
