Be less generic with package extension

Arch only uses .gz and .xz packages so look for .pkg.tar.?z.  This
prevents matching potential detached signature files.

Signed-off-by: Allan McRae <allan@archlinux.org>
Signed-off-by: Pierre Schmitz <pierre@archlinux.de>