CLSA-2026-1787335320 tar: Fix of CVE-2026-18477

CVE-2026-18477: apply safernamesuffix to incremental dumpdir 'X' entries so the temporary directory template can no longer escape the extraction directory - use mkdtempat instead of mkdtemp so the 'X' temporary directory is created relative to -C backport of upstream d479b2cc...