Safe map archive format

Following a brief discussion on Discord (ending [here](https://discord.com/channels/549281623154229250/554307356360441876/1503103112687386714)) surrounding an existing infrastructure issue: https://github.com/beyond-all-reason/infrastructure/issues/8 and the desire to test maps online in a lobby but without requiring the map go through normal approval processes or expose clients to scripting attacks from unvetted scripts in map archives.

As an alternative to an infrastructure-based solution to automate (or mostly automate) the approval of safe maps, it seemed to me that the underlying issue is simply that scripting attacks are possible in maps, via functionality that - as I understand it - the project is moving away from anyways.

The most restrictive version of this is a map archive format which has no scripting whatsoever (i.e. `.json` files instead of `.lua`, or whatnot). Its possible that a more forgiving format could be supported, so that lua-based functionality could still work, while still being able to guarantee to clients that malicious map files couldn't do any harm to their system. As Marek pointed out on discord, however, the impetus would first be upon the engine to support this map archive format.

The issue names no files, tests, or entry points. Start by identifying the engine’s map-archive loading and scripting boundaries, then define the archive format and client safety guarantee before implementation. Done means the engine supports the proposed format and unvetted map archives cannot execute harmful scripts.

Written by the indexing model from the issue text.