Improve package.xml detection. Allow for archives already tar-bomb safe with package.xml inside a packagename-x.y.x directory.
Changed paths: