cve-check: we don't actually need to unpack to check

The patch scanner works with patch files in the layer, not in the workdir, so it
doesn't need to unpack.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>