Fix 5658

Fix handling of foreign (ie, non-npm-created) tarballs.

This fixes #5658.

@othiym23: I'm not in love with the solution here, and it might need to be completely re-thought in light of the cache refactor going on in 2.0, but it is the minimal choke-point for catching this class of error.  Whatever we add, at some point, we unpack a tarball, so that's the proper place to be doing this (of course, we SHOULD also still do it when *generating* the tarball, since that leads to data in our system that is more correct.)
The code is easy to follow, so replace this comment with a comment explaining why this is here, maybe? It would be useful to know that this is to deal with "foreign" tarballs, and that there's a dual operation in `npm pack` that will do this renaming on tarball creation.