fix: refuse archive entry names that forge paths or lines

`entryName` only rejected NUL and over-long names, so whatever an archive called an entry flowed
straight into `FullPath`, the file tree and every encoder.

- a name containing `!/` could pose as a nested archive boundary and collide with a real nested entry
- control characters and unicode line separators could add lines to SPDX tag-value output

Both are now refused, and refused names (over-long ones included) mark the resolver truncated with
the quoted name instead of being dropped silently.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/archive/README.md

@@ -89,6 +89,7 @@ files. `AllLocations` enumerates every non-directory path, links included. Answe
   archive task is running, so the java cataloger leaves nested archives to the task instead of
   opening them itself.
 - `entryHeader`: keeps regular files, directories and links only (no devices or fifos), cleans entry names to
-  archive-relative paths, refuses names longer than PATH_MAX or containing NUL, and drops header
+  archive-relative paths, refuses names longer than PATH_MAX or containing control characters, line
+  separators or the `!/` archive path separator (marking the resolver truncated), and drops header
   fields nothing reads (PAX records, user and group names, sub-second and access times) since the
   header is held for the life of the archive.