Explain why we're not using ZIP

We have some hints in https://w3ctag.github.io/packaging-on-the-web/#intro, but it's not complete, and it needs to appear in the local explainer, not something remote.

Other considerations against zip:

• We've seen vulnerabilities caused by validating one copy of a resource but using a different one. #41 will avoid this for the CBOR-based format.
• Zip resources are identified by filename, which isn't the primary key of web resources.
• Zip resources don't include response headers.
• Lots of details in the format are archaic and wouldn't be used.

We should probably also list reasons in favor of re-using zip so that proponents know we've considered their arguments:

• A huge number of other formats are based on zip, so we're unlikely to run into something we can't express.
• Existing tools would be able to extract packages.

Start by locating the local explainer and compare its current packaging rationale with the linked W3C TAG introduction. Add a complete explanation of the arguments against ZIP, along with the stated benefits of reusing it, and account for the security concern referenced in issue #41. Done means the rationale appears locally rather than relying on a remote link.