What if the URL doesn't contain `.zip` at all? We need a more reliable check.

Maybe a regex that checks if it's a valid plugin/theme slug, i.e. only contains dashes etc.