bsdtar: reject appending to empty filtered archives

The filter check currently runs inside the entry loop. Empty filtered
archives reach EOF before entering the loop, so bsdtar rewrites them as
unfiltered archives and exits successfully.

Check the filter immediately after opening the archive. This keeps the
existing behavior for non-empty archives and prevents the original file
from being modified.