Fix CVE-2026-59873 and CVE-2026-59874 (nodejs-tar)

Backport CVE-2026-59873 fix by upgrading the bundled node-tar
package (within npm) from 7.5.15 to 7.5.19. The patch extracts
only the 13 tar-related files from the upstream npm 11.18.0
upgrade commit. Key security fixes include a
maxDecompressionRatio guard in the tar parser, rejection of
negative size values in headers and PAX extensions, and
String() wrapping in normalize-windows-path. Conflicts with
the RHEL base (7.5.15 vs expected 7.5.16) were resolved
manually in header.js, index.min.js, and package.json.

CVE: CVE-2026-59873, CVE-2026-58874
Upstream patches:
 - fd35018553.patch
Advisories:
https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w
https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw

Resolves: RHEL-193835 RHEL-193868
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

nodejs24.spec

@@ -152,6 +152,9 @@ Source101:      nodejs.srpm.macros
 %patchlist
 0001-Remove-unused-OpenSSL-config.patch
 0001-fips-disable-options.patch
+# Sourced from:
+# https://github.com/nodejs/node/commit/fd350185539242b7d383ebf38f6041f10b472b39
+0001-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch
 
 %description
 Node.js is a platform built on Chrome's JavaScript runtime