Remove local fork of archive/tar package
**- What I did**
Removed the local fork of `archive/tar` while retaining all existing mitigations of CVE-2019-14271. Fixes #42402

**- How I did it**
I hid the value containing the file's UID and GID from the `tar.FileInfoHeader` function [so that it would elide calling `user.LookupId`](https://cs.opensource.google/go/go/+/refs/tags/go1.17.6:src/archive/tar/stat_unix.go;l=28-31), analogous to the proposal in golang/go#50102.

**- How to verify it**
1. Comment out [the other mitigation](https://github.com/moby/moby/blob/559ff0ac661c1ca27bb17765629f6166d90ff499/pkg/chrootarchive/archive.go#L15-L20) and [the mitigation introduced in this PR](https://github.com/corhere/moby/blob/0ef67c6a9bdc7420210318fcef4fe0af3fc0cac6/pkg/archive/archive.go#L413-L421) and `make dynbinary`
2. Build a container image which exploits CVE-2019-14271 (an exploit payload which prints a message to stderr and exits nonzero makes it easy to spot in `dockerd`'s debug logs) and create a container from that image
3. `docker cp` from the container and observe that the exploit code has been executed
4. Uncomment the mitigation from this PR (leaving the other mitigation commented out), rebuild dockerd, and try to exploit the vulnerability again. Observe that the exploit payload does not execute.

**- Description for the changelog**
Remove local fork of `archive/tar` package

**- A picture of a cute animal (not mandatory but encouraged)**


hack/vendor.sh
#!/usr/bin/env bash

# This file is just wrapper around 'go mod vendor' tool.
# For updating dependencies you should change `vendor.mod` file in root of the
# project.

set -e
set -x

SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
"${SCRIPTDIR}"/go-mod-prepare.sh

if [ $# -eq 0 ] || [ "$1" != "archive/tar" ]; then
	GO111MODULE=auto go mod tidy -modfile 'vendor.mod' -compat 1.17
	GO111MODULE=auto go mod vendor -modfile vendor.mod
fi

if [ $# -eq 0 ] || [ "$1" = "archive/tar" ]; then
	echo "update vendored copy of archive/tar"
	: "${GO_VERSION:=$(awk -F '[ =]' '$1 == "ARG" && $2 == "GO_VERSION" { print $3; exit }' ./Dockerfile)}"
	rm -rf vendor/archive/tar
	mkdir -p vendor/archive/tar
	echo "downloading: https://golang.org/dl/go${GO_VERSION%.0}.src.tar.gz"
	curl -fsSL "https://golang.org/dl/go${GO_VERSION%.0}.src.tar.gz" \
		| tar --extract --gzip --directory=vendor/archive/tar --strip-components=4 go/src/archive/tar
	patch --strip=4 --directory=vendor/archive/tar --input="$PWD/patches/0001-archive-tar-do-not-populate-user-group-names.patch"
fi


#!/usr/bin/env bash

# This file is just wrapper around 'go mod vendor' tool.
# For updating dependencies you should change `vendor.mod` file in root of the
# project.

set -e
set -x

SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
"${SCRIPTDIR}"/go-mod-prepare.sh

GO111MODULE=auto go mod tidy -modfile 'vendor.mod' -compat 1.17
GO111MODULE=auto go mod vendor -modfile vendor.mod

Wah, sorry, looks like https://github.com/moby/moby/pull/43212 caused a merge conflict here, so another rebase is needed.

This now should be changed to

```bash
GO111MODULE=auto go mod tidy -modfile vendor.mod -compat 1.17
GO111MODULE=auto go mod vendor -modfile vendor.mod
```


(I'll try to get more eyes on this PR to see if we can get it moving 👍)