ociruntime: reapply tar unpack

[sluongng]

This change include a few small changes inside:

• Reapply "ociruntime: replace tar extraction subprocess with in-process (ociruntime: replace tar extraction subprocess with in-process #7589)" (Revert "ociruntime: replace tar extraction subprocess with in-process (#7589)" #8019)

• Add a basic image pull test and guard it with a separate, manual Bazel test target to help verifying common images.

• Fix issues with the previous implementation.
  Ensure that parent directory is created for file tar entries.
  Ignore unknown tar entry types (i.e. devices).

[sluongng]

--- PASS: TestPullImage (74.35s)
    --- PASS: TestPullImage/dockerhub_busybox (1.09s)
    --- PASS: TestPullImage/ghcr_nix (7.38s)
    --- PASS: TestPullImage/executor_image (17.39s)
    --- PASS: TestPullImage/executor_docker (24.34s)
    --- PASS: TestPullImage/workflow_2004 (14.00s)
    --- PASS: TestPullImage/workflow_2204 (10.16s)
PASS

Also tested some public images that our users used and did not find any issues.

[bduffany]

nit: we have a few of these types of targets elsewhere but they are a bit of a hassle to maintain because gazelle doesn't handle them properly. I think it would be fine to use a flag (instead of env var) to guard the test, and then people could run it by passing the flag to the "normal" test target, like bazel test enterprise/server/remote_execution/containers/ociruntime:ociruntime_test --config=remote --test_arg=-test_pull=true (optionally adding --test_filter=TestPullImage to run just that test case)

[sluongng]

will fix

[bduffany]

do we need to make the parent dir for TypeSymlink and TypeLink as well?

[sluongng]

yeah, I can add the create parent dir to all known cases

[fmeum]

As far as I understand hardlinks, this would change the metadata of the target, which is shared between all hardlinks. Since we ensure that the target is created by this tar and thus could have had a mode set, should we skip it here to prevent flip-flopping? I don't know how tar handles this.

[sluongng]

will remove this