[3.13] gh-157190: Fix tarfile data/tar filter bypass via hard link to a symlink

[StanFromIreland]

(cherry picked from commit 480ea4a)

• Issue: tarfile data/tar filter bypass via hard link to a symlink #157190

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @encukou for commit f21d8f3 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F157192%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[encukou]

(This is 3.13 so unrelated Buildbot failures are expected. There shouldn't be any in tarfile though.)

[miss-islington-app]

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker b8f23e307097552eaea2604383a12ab280520d0d 3.12

[miss-islington-app]

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker b8f23e307097552eaea2604383a12ab280520d0d 3.11

[miss-islington-app]

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker b8f23e307097552eaea2604383a12ab280520d0d 3.10

[bedevere-app]

GH-157454 is a backport of this pull request to the 3.12 branch.