deb source plugin can introduce non determinism

Summary

This is in the same vein as issue #540 (closed) for tar sources, as this source will simply treat the deb as an archive and extract it.

The result of extracting it, or at least staging it to the sandbox, should be guaranteed to be deterministic.