chore: workaround npm/cli#3466 when bundling internal deps

Works around npm/cli#3466 when bundling internal dependencies using the
bundleDependencies package.json property.

This change works in tandem with the npm pack/publish process -- when we
run `developer/src/kmc/build.sh publish` (or `pack`), we end up with
`npm version` stomping on all our package.json files, so the repo is
dirty after this. We need a copy of the top-level package.json before
this stomping happens, in order to get a simple map of the location of
each of our internal dependencies, from the `dependencies` property (it
would be possible to figure this out with a lot more parsing of
our package.json files, but this is simpler).

This means, in future, we should avoid publishing our internal
dependencies such as those under common/ to npm, as they serve no
practical purpose there.