refactor: make tarball.Extract package-format agnostic

[upils]

• Have you signed the CLA?

---

Prepare the extraction path for upcoming bin packages (plain XZ-compressed
tarballs), which today cannot be handled because the generic tar walker is
hard-wired to the .deb container format.

To decouple the two, tarball.Extract no longer imports deb: callers now
inject a TarOpener describing how to open the tar inside a package, and
deb.DataReader became deb.OpenTar. tarball.OpenXZTar is added as the
opener for plain XZ tarballs; it is not wired into the slicer yet — that lands with
the actual bin extraction support.

The opener is a positional argument rather than an ExtractOptions field: it is
mandatory, and a nil-checked struct field would have let callers omit it and hit
a runtime error instead of a compile error. Note Extract may invoke the opener
twice for one package — the hard-link pass rewinds and re-reads the tarball — so
implementations must not carry state between calls. It takes an io.Reader, not
an io.ReadSeeker, since rewinding remains Extract's responsibility.

[niemeyer]

This is documenting a "package" inside internal/tarball.

It's a bit late here so that doesn't help, but this PR seems to suffer a bit from lack of clarity and precision about the encapsulations it's introducing and changing. In theory, if you want to "extract bins", we shouldn't have to touch the interface of either deb or tarball.

Happy to be lessoned on what you had in mind, though.

[upils]

The main goal of this PR is exactly to not have to touch the interface of either deb or tarball anymore in the future. But I think it is worth adapting it a bit right now when preparing for multiple tarball containers, rather than later.

So far the tarball extraction logic assumed a deb was extracted. The TarOpener abstracts how the container looks like (ar, etc.) and gives a io.ReadCloser to the tarball logic. deb.DataReader was also needlessly receiving a io.ReadSeeker when it only needs a io.Reader, so I refined it while defining the TarOpener interface.

As a result of these changes, tarball does not depend on deb anymore and the extraction logic does not assume it works on a deb either.

I have rework the documentation to avoid mixing independent concepts.

[upils]

[Note to reviewer]: This will be used in a follow-up when receiving bins from the store. A case could be made to move this under a internal/bin/ package but:

• it seems overkill just for one function for now.
• other future packages might also be XZ-compress tarballs, so it would require moving this again.

So I propose keeping it here for now until we know more where could be a better place.