Currently, it's used the archive.ReplaceFileTarWrapper
that requite a []byte of the files replaced. This is not
a good idea if files are big and instead could be better
in the near future reimplement ReplaceFileTarWrapper with
a callback that return io.Reader instead of []byte.
If a protected file is already present on target rootfs
it is created a file with the same prefix used in Gentoo:
._cfgXXXX_<filename>
