resolve npm imports

[mbostock]

This resolves the exact version of any imported npm module at build time. This improves performance by allowing cache-control immutable for imported modules and by preventing duplicate loads of the same library. (For example, the npm:d3-dsv needed for file.csv() is now the same as the one you get if you import npm:d3.) It also improves security and stability by ensuring that new releases won’t break your existing project, while still automatically giving you the latest version at build time. We could further improve security using subresource integrity.

I’ve staged this as a PR on top of #294 because it depends on some upstream changes, but I also didn’t want to add yet more new functionality to that already-large PR!

TODO

• resolve the exact npm version
• use a cache to avoid duplicate requests and ensure consistency
• resolve implicit stylesheet versions (Leaflet, KaTeX, and Observable Inputs)
• resolve DuckDB dependencies
• resolve SQLite dependencies
• mock jsDelivr during tests to be polite, improve performance, and keep the snapshots stable
• clean up the PendingTranspile complexity somehow

Fixes #135. We can fix the Inputs stylesheet after #29.

[Fil]

This will be useful also for #20. I've opened an issue for SRI (#306).