checkpkg: avoid using PKGEXT to guess tarball name

We can't rely on PKGEXT since it's not sourced from a controlled
location. Case in point, if a user sets PKGEXT=.pkg.tar.gz, checkpkg
fails and offers no easy workaround.

Instead, use glob expansion to resolve the name of the tarball, bailing
if it can't be found definitively. This involves some refactoring to
avoid modifying PWD (which is advisable regardless).

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Pierre Schmitz <pierre@archlinux.de>