rpctest: filter tar members on extraction; document two API contracts

[xanimo]

rpctest/fetch.py extracts a downloaded archive unfiltered

tar.extractall(os.getcwd())

No member filtering, so a crafted archive writes outside the destination via ../ members, absolute paths, or symlinks pointing out of the tree.

Demonstrated, not assumed. An archive whose only member is ../escaped.txt:

UNFILTERED -> escaped file written outside dest? True
  contents: pwned

With filter='data', the same archive:

filter=data REFUSED: OutsideDestinationError
escaped file created outside dest? False

The checksum check above the extraction narrows who can supply such an archive, but it doesn't make extraction safe — those are independent concerns, and the fix costs nothing.

Note the .zip branch was never exposed: Python's zipfile.extractall already sanitises member paths. Only tar needed this.

Uses filter='data' where available. Where it isn't — PEP 706 landed in 3.12 and was backported to security releases of 3.8+ — it checks members by hand rather than silently extracting unfiltered; both the member path and any link target must resolve inside the destination.

Two contracts that were only discoverable by reading the implementation

dogecoin_generate_mnemonic's entropy_out needs MAX_ENTROPY_STRING_SIZE bytes — the type is really HEX_ENTROPY, but the signature says char*, so the requirement is invisible at the call site.

Worth being precise about severity here, because static analysis flags the strcpy as an unbounded write and it isn't one: entropy_size is validated to 128–256 bits before use, which caps the output at 64 hex characters plus a terminator. It's a documentation gap, not an overflow. I'd rather say that plainly than let it get filed as a buffer overflow.

dogecoin_cheap_random_bytes is exported under a name that invites misuse. It's seeded from the wall clock and is not cryptographic. In-tree use is appropriate — P2P nonces only — and the comment now says so, and points at dogecoin_random_bytes for anything else.

---

No functional change to the library; the only behaviour change is in a test helper script.

This will show red on cppcheck until #403 lands — that job fails on 0.1.5-dev itself, not on this branch.