Fix: GHSA-gvwx-54wh-qm9j

This prevents a case where the path can be set to a number.

We were effectively already ignoring unknown types anyway, so we may as
well just have a short allowed list of values, and handle them
deliberately.

Also, just as a defense-in-depth, any paths that pass through
normalizeWindowsPaths (which we use whenever paths are considered) is
explicitly cast to `String`.

Previously, a PAX header with an entry like `11 path=12345\n` would
cause a crash in strict mode, or a failure to extract in nonstrict mode,
because it would attempt to substring a number value.

Fix: GHSA-w8wr-v893-vjvp

fix: GHSA-8x88-c5mf-7j5w

EDIT(@isaacs): add to readme, remove dead code, full test coverage