Windows: tarball and zip handlers return OS-native path separators instead of normalized repository paths

### Summary While running Scorecard tests on Windows 11 with Go 1.26.4, I observed failures in both the GitHub tarball and Azure DevOps zip handlers due to path separator differences. The tests expect repository-style paths using forward slashes (`/`), but the handlers return Windows-native paths using backslashes (`\`). ### Environment - OS: Windows 11 - Go: go1.26.4 - Repository: ossf/scorecard - Branch: main ### Reproduction GitHub tarball handler: go test ./clients/githubrepo -run TestExtractTarball -v Azure DevOps zip handler: go test ./clients/azuredevopsrepo -run TestExtractZip -v ### Expected Behavior Repository-style paths should be returned consistently across platforms: dir1/file1 dir1/dir2/file2 ### Actual Behavior On Windows, the returned paths use native separators: dir1\file1 dir1\dir2\file2 Example test output: Expected: ["file0" "dir1/file1" "dir1/dir2/file2"] Got: ["file0" "dir1\\file1" "dir1\\dir2\\file2"] ### Investigation I traced the issue to the file extraction handlers where extracted file paths are stored after trimming the temporary directory prefix. For example, in `clients/githubrepo/tarball.go`: ```go handler.files = append( handler.files, strings.TrimPrefix( filenamepath, filepath.Clean(handler.tempDir)+string(os.PathSeparator), ), )