[3.12] gh-130577: tarfile now validates archives to ensure member offsets are non-negative (GH-137027) (#137171)

(cherry picked from commit 7040aa54f14676938970e10c5f74ea93cd56aa38)

Co-authored-by: Alexander Urieles <aeurielesn@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>