ExtractTar extracts a tarball (from a io.Reader) into the given directory
if pwl is not nil, only the paths in the map are extracted.
If overwrite is true, existing files will be overwritten.
The extraction is executed by fork/exec()ing a new process. The new process
needs the CAP_SYS_CHROOT capability.
Map of paths that should be whitelisted. The paths should be relative to the
root of the tar file and should be cleaned (for example using filepath.Clean)