Permission issues in the release tarball

Describe the bug
The compressed tarball for this package in the Yarn registry has some permission issues preventing it from being correctly extracted.

To Reproduce
Steps to reproduce the behavior:

1. With an unprivileged user initialize a package.json file:
   yarn init -y
2. Add this project as a dependency:
   yarn add matrix-widget-api
3. Get the URL in the Yarn registry and download the tarball:

$ pkg_url=$(cat yarn.lock | grep ".com/matrix-widget-api" | awk -F'"' '{ print $2 }')
$ wget "${pkg_url}"

4. Extract the archive:

$ mkdir extracted
$ tar zxvf matrix-widget-api-*.tgz -C extracted/

5. Lots of errors will appear:

package/src/models/validation/utils.ts
tar: package/src/models/validation/utils.ts: Cannot open: Permission denied
tar: Exiting with failure status due to previous errors

6. If you retry the extract command with the --delay-directory-restore flag, it works at first, but a few directories will miss the execute attribute:

$ tar zxvf matrix-widget-api-*.tgz --delay-directory-restore -C extracted/
$ rm -rf extracted/
rm: cannot remove 'extracted/package/src': Permission denied
rm: cannot remove 'extracted/package/LICENSE': Permission denied
rm: cannot remove 'extracted/package/lib': Permission denied
rm: cannot remove 'extracted/package/README.md': Permission denied
rm: cannot remove 'extracted/package/dist': Permission denied
rm: cannot remove 'extracted/package/CONTRIBUTING.rst': Permission denied
rm: cannot remove 'extracted/package/package.json': Permission denied

7. It's possible to fix the errors from (6) by adjusting the attributes:

$ find extracted/ -type d -exec chmod a+x {} \;
$ rm -rf extracted/
# works now

Expected behavior
Extraction was expected to work correctly without the need for extra flags and operations, similarly to other projects. For example, matrix-js-sdk:

$ yarn add matrix-js-sdk
$ pkg_url=$(cat yarn.lock | grep ".com/matrix-js-sdk" | awk -F'"' '{ print $2 }')
$ wget "${pkg_url}"

$ mkdir extracted
$ tar zxvf matrix-js-sdk-*.tgz -C extracted/
$ rm -rf extracted
# works right away

Desktop (please complete the following information):

• OS: Linux Mint 19.3 Tricia
• Yarn: 1.7.0
• tar: GNU tar 1.29

Start by reproducing the extraction failure as an unprivileged user using package.json, yarn.lock, and the published matrix-widget-api tarball. Inspect the archive's permissions, especially under package/src/models/validation/utils.ts, and compare with the matrix-js-sdk archive; done means extraction and removal work without extra flags or chmod operations.