Set safe default extraction filter for tar archives

[nsoranzo]

PEP 706, first implemented in Python 3.11.4, mitigates some of the security issues of TarFile.extract() and TarFile.extractall() by allowing to specify a filter keyword-only parameter.
Set a safe default (data_filter) for the filter if available, reverting to Python 3.11 behavior ('fully_trusted') otherwise, see https://docs.python.org/3/library/tarfile.html#supporting-older-python-versions

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[jdavcs]

@nsoranzo Would it make sense to factor out all the tar_archive.extraction_filter = getattr(tarfile, "data_filter", (lambda member, path: member)) into a helper, and then add a comment to that helper? The PEP suggests to do so ("..This is an unsafe operation, so it should be spelled out explicitly, ideally with a comment")

[nsoranzo]

@nsoranzo Would it make sense to factor out all the tar_archive.extraction_filter = getattr(tarfile, "data_filter", (lambda member, path: member)) into a helper, and then add a comment to that helper? The PEP suggests to do so ("..This is an unsafe operation, so it should be spelled out explicitly, ideally with a comment")

That was a good idea suggestion, I've extended the existing CompressedFile wrapper for that, and used it everywhere we are extracting from an archive.

[jdavcs]

Looks great, thank you!

EDIT: test failures seem relevant.

[nsoranzo]

EDIT: test failures seem relevant.

Fixed, thanks for the review!

[github-actions]

This PR was merged without a "kind/" label, please correct.