tar: ignore node-tar CVEs

These two CVEs are specific to the Node package node-tar.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>