Validate tar members before extracting remote playbook packages (#2144)