RUSTSEC-2026-0425 — `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

`nix-nar`'s `Decoder::unpack` does not safely contain extracted paths. A malicious NAR archive can create files outside the destination directory.