fix: refuse archive entry names that forge paths or lines

`entryName` only rejected NUL and over-long names, so whatever an archive called an entry flowed
straight into `FullPath`, the file tree and every encoder.

- a name containing `!/` could pose as a nested archive boundary and collide with a real nested entry
- control characters and unicode line separators could add lines to SPDX tag-value output

Both are now refused, and refused names (over-long ones included) mark the resolver truncated with
the quoted name instead of being dropped silently.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/archive/extract.go

@@ -140,7 +140,7 @@ func (r *Resolver) extract(ctx context.Context, format archives.Extractor, conte
 		return err
 	}
 	err := format.Extract(ctx, content, func(_ context.Context, f archives.FileInfo) error {
-		hdr, ok := entryHeader(f)
+		hdr, ok := r.entryHeader(f)
 		if !ok || exclusions.Excludes(hdr.Name) {
 			return nil
 		}