Use a more defensive vendored archive/tar import path to make it clear this isn't upstream's released archive/tar

/cc @creack @vieux