File overwrite via unchecked outfilename path

Path traversal in SLES 15 and openSUSE Factory obs-service-tar_scm allows remote attackers controlling a repository to overwrite local files. The obs-service-extract_file service accepts an outfilename containing path separators and writes extracted content without confining the destination to the package directory. Exploitation requires the local user to execute a malicious repository-supplied service, after which attacker-selected files can replace files writable by that user.