Symlink to .bazelrc outside zip causes error when extracting 0.9.0 release archive

[benradf]

Describe the bug
With this in WORKSPACE:

http_archive(
    name = "io_tweag_rules_nixpkgs",
    strip_prefix = "rules_nixpkgs-0.9.0",
    urls = ["https://github.com/tweag/rules_nixpkgs/archive/refs/tags/v0.9.0.zip"],
    sha256 = "a8f4cc94757f19a0a1ce95245f7a87f294cfbce9859ed55ffaeeacf6f0d0af16",
)

The following error occurs:

ERROR: no such package '@rules_nixpkgs_python//': java.io.IOException: Error extracting /home/w/.cache/bazel/_bazel_w/ef63e3bfe165b0613795ad5212904c1a/external/rules_nixpkgs_python/temp15388650320627280841/v0.9.0.zip to /home/w/.cache/bazel/_bazel_w/ef63e3bfe165b0613795ad5212904c1a/external/rules_nixpkgs_python/temp15388650320627280841: Zip entries cannot refer to files outside of their directory: v0.9.0.zip has a symlink .bazelrc pointing to ../../core/.bazelrc

Additional context
See this thread for additional context.