Define guidelines about what kind of assets should be included in packages

Over the past month, quite a few asset types were added to the package-spec. Recently a discussion was raised around what is allowed in a package and what not. Can API Keys be shipped as part of a package, user definitions etc.?

This issue is to discuss on how we could find and define a general concept on what fits and what doesn't.