Detect non-gzipped tar files more reliably

In addition to starting with the string `package/`, they may also start
with a `pax_global_header`, and this is almost certainly an indication
that we are dealing with a tar file.  For example, git adds a global
header with the commit sha when producing archive files.
rename .gitignore when unpacking foreign tarballs

Fix #5658

Note that this doesn't actually *ignore* the files specified by the
.gitignore and/or .npmignore files.  That would likely require removing
them after the fact, as well as all the same logic that exists in
fstream-npm, since tar does not give us a directory listing, and
tarballs may have their files in any random order.