Guard tar extraction against path traversal in model download (#1175)

While fixing #1163 I read through the rest of the download path and
noticed the
tar extraction at line 8554 calls `tarfile.extractall()` with no
`filter=`.

`zipfile` strips `..` automatically and the two zip sites here (5449,
10792) get
that for free. `tarfile` never has. A member named `../evil.txt` writes
one
directory above the target, silently, without raising.

`safe_extract_tar()` uses `filter="data"` where available, else vets
members with
`realpath` containment checks. Detection is `hasattr(tarfile,
"data_filter")`, not
a version check . `filter=` was backported to 3.11.4 and
`requires-python
">=3.11"` still admits 3.11.0–3.11.3, where passing it raises
`TypeError`.

Tests cover the helper and the wiring.

Not verified whether Kaggle sanitizes member names server-side. Happy to
drop the fallback and require
>= 3.11.4 instead. It guards four superseded releases and has a TOCTOU
gap that
`filter="data"` doesn't. Hope that helps!