Move tarsum to pkg/

Pretty straightforward, no logic changes.
Actually, I would argue it shouldn't even use `log`. You don't see `archive/tar` using `log`. I'm not sure what the right solution could be here, an ugly one is to provide a log function to the package that clients can set.