Provide a more nuanced pax vendor policy

[woodruffw]

Our policy is currently binary: we reject unknown pax vendor extensions by default, and users can enable them with allow_unknown_pax_vendor_records.

However, what we actually want is:

1. The default policy should probably remain as rejecting pax vendor extensions
2. Users can configure a "harmless" list, i.e. pax vendor extensions to skip while rejecting others
3. Users who want to live dangerously can enable all unknown pax vendor extensions

[woodruffw]

Specifically I'm imagining something like:

enum PaxVendorExtensionPolicy {
  #[default]
  RejectUnknown,
  Ignore(HashSet<&'static str>),
  AllowUnknown,
}

and then:

let mut policy = PaxDecodePolicy::default();
policy.vendor_extension_policy = ...;

which would replace allow_unknown_pax_vendor_records.

[woodruffw]

This matters for astral-sh/uv#19979, where we want to skip some harmless records that appear sometimes but skip others.