Decompress files for config_install

The Needs Review Queue Bot → tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

Do we need to get the default_config_hash keys in the config?

I think that's a valid question, but since this is a security issue should that be a followup since this is just exporting the tars as is?

The only config change I did was add a missing newline so the validation would work.

I'm not sure how to scope security issues.

That I cannot answer unfortunately. But +1 for breaking out though