extract: use open(create=true) when extracting files

[StefanKarpinski]

Using open's create flag when extracting files should prevent certain kinds of attacks if all our other defenses don't catch them, e.g. writing CON on Windows or /etc/passwd on UNIX. Closes #147.

[StefanKarpinski]

@vtjnash, is this what you had in mind?

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.37%. Comparing base (6bfc114) to head (0dc24db).
⚠️ Report is 36 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #148   +/-   ##
=======================================
  Coverage   97.37%   97.37%           
=======================================
  Files           4        4           
  Lines         801      801           
=======================================
  Hits          780      780           
  Misses         21       21           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.