[TarFile]: normalize also concatenated paths (#1072) (#1073)

* [TarFile]: normalize also concatenated paths (#1072)

The result of `normalize_path()` may be a non-normalized path,
containing e.g. `../`, as a result of prepending `self.directory`.

Avoid the problem by using `normpath()` on the result.
Resolves #1072.

* Fix merge errors

* Fix merge noise

* Include from previous commit

* Address reviewer feedback - previous fix broke the case of leading './'

pkg/private/tar/build_tar.py

diff --git a/pkg/private/tar/build_tar.py b/pkg/private/tar/build_tar.py
index 900f284..5ecfccf 100644
--- a/pkg/private/tar/build_tar.py
+++ b/pkg/private/tar/build_tar.py
@@ -89,7 +89,10 @@
     # the /a/b/a/b/rest... output we can start an issue and come up with a
     # solution at that time.
     if self.directory and not dest.startswith(self.directory):
-      dest = self.directory + dest
+      dest = normpath(self.directory + dest)
+      # Preserve the leading slash that normpath strips (see #570).
+      if self.directory == './':
+        dest = './' + dest
     return dest
 
   def add_file(self, f, destfile, mode=None, ids=None, names=None, mtime=None):