fix: plugin bundle archive handling for upload and install (#23983)

Move plugin tar.gz packing and unpacking into a shared core-plugins
archive helper so uploaded bundles are decoded through the same tar
handling used for installs. This removes duplicate archive logic,
supports GNU long-name entries on extraction, and keeps size, traversal,
link, and entry-type checks in one place.

codex-rs/core-plugins/src/lib.rs

@@ -6,6 +6,7 @@ pub mod marketplace;
 pub mod marketplace_add;
 pub mod marketplace_remove;
 pub mod marketplace_upgrade;
+mod plugin_bundle_archive;
 pub mod remote;
 pub mod remote_bundle;
 pub mod remote_legacy;