Strip the first directory on extraction, otherwise you end up with /etc/apache2/mod_security/crs/rules/owasp-modsecurity-crs-2.2.8