Improve the '.xdc' file format specification

[sambacha]

Looking at the specification https://webxdc.org/docs/spec/format.html I find some potential issues / questions regarding the format:

XDC Format

• ZIP settings such as compression, etc, are not defined explicitly

• Make the zipping process reproducible: Last-modified timestamps & File-system permissions (mode) for the archive files.

• Specify a max file size. (I belive this is already the case as see here https://github.com/webxdc/hello/blob/d648febd18ec809ecbd5681f1fc6d4b5273b3e52/create-xdc.sh#L23 )

• manifest toml file does not define if additional properties are allowed

• clarify where it says that manifest toml says if manifest.toml exists it MUST read source_code_url however this is stated as an optional field.

Suggestions

• define a 'scope' for which html pages can be loaded besides index.html for the user. E.g. a 'debug' page may be scoped for development purposes but disabled for normal installs
• an "integrity hash" or SRI hash, which is basically a checksum over the source file inputs. it is intended to let consumers easily validate

[r10s]

compression is defined:

the ZIP-file MUST use the default compression methods as of RFC 1950, this is "Deflate" or "Store"

source_code_url is optional from app-developer view; from messengers-implementors-view, it must be read if present (currently the spec covers both views)

additional fields: webxdc-apps must write strictly to the spec, messenger impementations otoh willl ignore them

the spec does not define max file size, that seems not to be needed. but messenger-impementations and stores may have some.
in practise, several mb are okay, tho smaller is always better here

for timestamps.: as long as this fore not increase adaption barriers maybe makes sense to define more accurate. for webxdc, they're just ignored

anyways, a PR is welcome :)