Fix 5658

Fix handling of foreign (ie, non-npm-created) tarballs.

This fixes #5658.

@othiym23: I'm not in love with the solution here, and it might need to be completely re-thought in light of the cache refactor going on in 2.0, but it is the minimal choke-point for catching this class of error.  Whatever we add, at some point, we unpack a tarball, so that's the proper place to be doing this (of course, we SHOULD also still do it when *generating* the tarball, since that leads to data in our system that is more correct.)
unrelated change?