Alternative to #1121.

"Locks" the full dependency tree for consumers by bundling the dependencies (as constrained by our own package-lock.json) with the published package.

The size of the @node-core/utils package goes from

npm notice Tarball Details
npm notice package size: 206.1 kB
npm notice unpacked size: 839.8 kB
npm notice total files: 108

to

npm notice Tarball Details
npm notice package size: 8.0 MB
npm notice unpacked size: 39.7 MB
npm notice bundled deps: 355
npm notice bundled files: 0
npm notice own files: 7076
npm notice total files: 7076

although the dependencies that are now bundled would previously have to be resolved and installed by npm anyway.

The main differences from shrinkwrap:

• npm extracts the bundled node_modules tree verbatim into node-core-utils/node_modules, as opposed to performing npm dependency resolution with fixed versions from npm_shrinkwrap. This means that it's no longer possible for npm to perform any deduplication at parent levels, so in the theoretical worst-case scenario where node-core-utils is installed globally alongside a load of other packages that have near-identical dependencies, this could add a maximum of ~40MB in no-longer-deduplicated node_modules overhead (although in reality this should never be a significant issue).
• In what appears to be an npm bug, npm pack goes into an infinite resolution loop if a bundled dependency is overridden by an overrides entry, which we were relying upon until recently (984125a). I'll report upstream, but for the time being, we wouldn't be able to call upon this feature if needed.

Fixes: #1078