Tarball processing fix

:fork_and_knife: 

This ought to fix #436. I'd like to wait to merge until #442 is fixed, though, to prevent any duplicate dependency badness.

The root cause looks to be that certain versions of `tar` include a `PaxHeader` directory in the tarball. This PR makes the metadata.json/README search more precise to avoid using the files in this directory. It also adds a migration to mark affected `CookbookVersion` records for re-import.