rename .gitignore when unpacking foreign tarballs

Fix #5658

Note that this doesn't actually *ignore* the files specified by the
.gitignore and/or .npmignore files.  That would likely require removing
them after the fact, as well as all the same logic that exists in
fstream-npm, since tar does not give us a directory listing, and
tarballs may have their files in any random order.
tar.js: Comment should describe why not what