Sanitise tarballs in mirror client

Within mirror client, clean items outside main package directory from
tarballs before attempting to upload them.  Some package tarballs have
extraneous stuff in them (pax_global_header files, MacOS hidden files,
etc.) that causes them to fail the "tarbomb" test in the server.