Validations: - [x] the same size validations as [we currently do for package tarballs](https://github.com/hexpm/hex_core/blob/v0.5.0/src/hex_tarball.erl#L7:L8) - [ ] [ensure top-level file is not a valid semver](https://github.com/hexpm/hexdocs/blob/3e52a7bd94227cb7fd7adfd3d697cbd106d6b456/lib/hexdocs/tar.ex#L48:L59)
