propagate check_magic_bytes through bz2/lzma/gzip archive scans

[abdul-khaliq-khalid]

_extract_and_scan_archive forwards check_magic_bytes to the recursive security_scan call on the zip and tar branches, but the bz2, lzma and gzip branches leave it off, so those three fall back to the default and re-enable the fast-path rejection the caller explicitly asked to turn off. A protocol-0 pickle is all ASCII, so prefixing one with a CODE_KEYWORDS string like use gets it fast-path rejected as source code; scanning those bytes raw with check_magic_bytes=False scores unsafe: 3 and the same bytes in a zip also score unsafe: 3, but gzip, bz2 or xz wrapping drops them to unsafe: 0, so recompressing is enough to hide a payload from a caller who opted into the stricter scan. Passing the flag through at the three sites lines the compressed branches up with the raw and zip paths, and I checked benign and malicious pickles at protocols 0 and 5 to confirm the default check_magic_bytes=True behavior is unchanged.