asar not verifying filenames before passing them to minimatch

[Stanzilla]

While working on tracking down a bug with sharp, we found that asar is not verifying file names before passing them to its minimatch dependency.

electron/asar@94cb8bd/lib/asar.js#L123

isaacs/minimatch@6410ef3/minimatch.js#L128