Defer dereferencing/unpacking until deposit no longer in progress

[alexdutton]

The server implementation should have a configurable option to defer unpacking and de-referencing by-reference files until after the deposit is complete.

It's possible that without this a client can leave a deposit in an inconsistent state, by uploading a package and then deleting it while it's being unpacked. It's possible one could prevent it from being deleted (which would be surprising for the client), or else make a note to delete any of the files that (would) have been unpacked.

At the time of writing, we should leave this as it is, and come back to it later if deemed sensible.