Archive extraction with path-traversal protection.
Both tar_gz and [zip] iterate an archive in memory and write selected
entries beneath dest. strip_prefix (e.g. Some("package/") for npm
tarballs) is removed from each entry path before Select is applied.