Also ensures cleanup of decompressed files/directories.

Removes Node 8 from the build matrix. The current version of ava is not
compatible with Node 8, and Node 8 is in general now at end-of-life.

When applied to a path containing a symlink, `fs.writeFile` will write
to the place that symlink points.

Because `fs.realpath` requires an actual file to exist, we can't rely on
it to detect if a symlink might point outside the output directory.

Traversing chains of symlinks, where the targets might be relative or
absolute, missing or not, gets complicated very quickly. And because
the behavior is generally surprising, of file creation writing through
to a pre-existing symlink's target, it seems preferable to disallow that
behavior.

This was useful on MacOS to expose a bug, where `/tmp` was symlinked to
`/private/tmp`, but because the build runs on a Linux host where
`/private` is inaccessible and the preceding test does the trick, we can
lose this in CI.