fix: harden tar extraction path validation

[dfgvaetyj3456356-hash]

Description

Tightens the Python < 3.12 fallback path validation used by custom_extractall_tarfile.

The fallback now validates tar members against the actual extraction directory with os.path.commonpath() instead of a raw string-prefix comparison. This avoids accepting paths that merely share the same textual prefix as the target directory, and keeps the fallback behavior closer to the Python 3.12+ filter="data" path.

The fallback also skips special file members, matching another important filter="data" safety behavior.

Testing

python -m py_compile sagemaker-core/src/sagemaker/core/common_utils.py sagemaker-core/tests/unit/test_common_utils.py
git diff --check
python -m pytest sagemaker-core/tests/unit/test_common_utils.py::TestCustomExtractallTarfile -q

Result: 3 passed for the focused extraction tests.