fix(deps): bump moby/go-archive to v0.3.3 for the tar path-traversal fix

[IAmBod]

Closes the one open Dependabot alert on main — #16, high severity:
a crafted tar archive can write outside the extraction directory in
moby/go-archive before v0.3.0.

Why a direct bump of an indirect dependency

go mod why puts it behind testcontainers:

github.com/iambod/rss2msg/test/awslocal
github.com/testcontainers/testcontainers-go
github.com/moby/go-archive

So the reachable exposure is test-only — the integration suite extracting
image layers, not the service handling feed data. It is still worth fixing
rather than dismissing: it is the only thing standing between this repo and a
clean security tab, and main is about to be a public branch.

testcontainers-go is already at its latest release (v0.44.0) and still requires
go-archive v0.2.0, so there is no upstream version to move to — hence the
direct requirement. v0.3.3 is the current patch on the fixed line.
moby/sys/user v0.4.0 → v0.4.1 rides along as a transitive requirement.

Verification

Because the consumer is behind the integration build tag, an untagged build
proves nothing on its own — so this was checked both ways:

• go build ./... clean; go vet -tags=integration ./... clean, which
  typechecks the testcontainers call sites against the new version.
• go test -race ./... — 48/48 packages ok. golangci-lint run ./... — 0 issues.
• Real containers, since an API-compatible bump can still break at runtime:
  ./internal/coord/redis and ./internal/sink/nats pass, and
  ./internal/coord/dynamodb passes — that last one is the LocalStack path
  through test/awslocal, i.e. the exact consumer named above.