add PERU_PLUGIN_TMP to the plugin interface

Summary:
Doing tar and zip unpacking looks like it's going to need temporary
files. We could expect plugins to use the global temp dir, but so far
we've been trying to avoid that. @sean let me know what you think.

Reviewers: sean

Subscribers: sean

Differential Revision: https://phabricator.buildinspace.com/D153
add the unpack field to the curl plugin

Summary:
Provides native support for tar and zip unpacking. Python documentation
on `tarfile` warns about using the `extractall` method on untrusted
archives, so we try to check for the evil paths that it mentions.

Test Plan: New tests.

Reviewers: sean

Differential Revision: https://phabricator.buildinspace.com/D154
README update

Summary:
Replace use of `build` with the new `unpack` field, and clean up the
type section.

Reviewers: sean

Differential Revision: https://phabricator.buildinspace.com/D155
deprecate `build` in the README

Reviewers: sean

Differential Revision: https://phabricator.buildinspace.com/D156