Windows App PKG name/version/bundle extracts as Microsoft AutoUpdate on custom package upload

[iansltx]

Fleet version: <= 4.72

---

💥  Actual behavior

Windows app (download URL extracted from homebrew) grabs the name and bundle ID from Microsoft AutoUpdate when extracting metadata on custom package upload, rather than grabbing the correct package information.

🧑‍💻  Steps to reproduce

Add the linked PKG as a custom package in Fleet.

🕯️ More info

Split from #25407. Very similar to #24083.

Suspicious Package shows that MS AutoUpdate is indeed in the package (extracted to Application Support) but Windows App is in the package as well. We're grabbing name/bundle ID/version from AutoUpdate (com.microsoft.package.Microsoft_AutoUpdate.app) rather than from Windows App (com.microsoft.rdc.macos).

🛠️ To fix

Revise PKG metadata extraction (xar.go) again to pull the right package for name/version/bundle ID purposes, while maintaining correct behavior for existing PKG files.

[iansltx]

Of note, we could provide a quick fix sooner for the prospect by adding Windows App as a Fleet-maintained app, since that lets us make an end-run around metadata extraction idiosyncrasies. We should still fix metadata extraction, but that would allow us to provide a solid workaround before 4.72 is out, let alone 4.73. /cc @mostlikelee @allenhouchins

[allenhouchins]

Related: #31256

[iansltx]

Sorry, this wasn't linked in the other ticket so I thought it hadn't been created yet. Closing this one, and will move my FMA comment over to the other one.

[fleet-release]

Metadata misreads,
Fleet's vision now refined,
True names shall proceed.