chore: update tar-fs to fix security vuln (#5779)

Note google-datastore-emulator hasn't been updated in over a year, so
choosing to manually override tar-fs

Fixes
#[2140](https://github.com/googleapis/repo-automation-bots/security/dependabot/2140)🦕

Author: ldetmer