vault: Open the beginning of the tarball to check it makes sense.

This can catch potential errors like file corruption, wrong encoding, crashes after response headers were sent, etc.

---

Migrated from D7298 (view on Phabricator)