Unpacking should happen outside the HTTP request

[alexdutton]

At the moment, uploaded packages are unpacked immediately, while the client waits for a response.

This is sub-optimal, as unpacking could feasibly take a long time, and the client might time out the request.

Instead, we should accept the file, maybe with initial validation (probably just media type), and then unpack it later in a celery task.