fix: let tarfile auto-detect archive type

[sevbch]

Context

When scanning a docker image, one could encounter this error when scanning layers files:

tarfile.ReadError: invalid header

What has been done

This happened because when dealing with layers files, code was implicitly assuming they were .tar files by using tarfile.TarFile.

Instead, we use tarfile.open which automatically detects the compression format (based on file extension, or in our case headers) and returns the relevant TarFile instance (matching the appropriate compression/decompression algorithm).

Validation

Added a non-regression test. It contains a layer with a .tar.gz file. Parsing failed before, doesn't fail anymore.

Note

In docker image manifest.json file, sometimes there is a mediaType field indicating the content type of each component. However this field isn't mandatory (it's part of the Docker Registry API V2 specs) so we can't rely on it to choose the relevant decompression method.

Also it's simpler to let tarfile module handle it for us.

PR check list

• As much as possible, the changes include tests (unit and/or functional)
• If the changes affect the end user (new feature, behavior change, bug fix) then the PR has a changelog entry (see doc/dev/getting-started.md). If the changes do not affect the end user, then the skip-changelog label has been added to the PR.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.88%. Comparing base (d68cb5c) to head (440d59f).
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1084   +/-   ##
=======================================
  Coverage   91.88%   91.88%           
=======================================
  Files         144      144           
  Lines        6066     6066           
=======================================
  Hits         5574     5574           
  Misses        492      492           

Flag	Coverage Δ
unittests	91.88% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[agateau-gg]

nitpicking on the changelog, but looks good, approved.