One challenge: that's the URL to a zip file, not the raw asset - so we may need to teach this plugin how to unzip a file.

Originally posted by @simonw in #1

Realized that GitHub Artifact URLs are zip files.

I don't want to fall victim to zip bombs, so before unzipping should inspect the contents of the zip file to ensure it's only a single file and it has a sensible uncompressed size.