xtarfile: vendor, rather than lib

since the 'xtarfile' is really just a vendored copy of stdlib 'tarfile',
move it out of ./lib/ to a directory called vendor.
This also helps with the coverage analysis (since it does an inclusive
mask over ./lib)

Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)