Add Compiler.forbidPackage() / allow for more complex package rules

...to support forbidding access to `js.html` in hxnodejs (now possible thanks to #7894).

This would also mean extending package rules to work with subpackages - right now `--remap`, `--macro allowPackage()` etc only seem to work with top-level packages. Things like "what's the most specific rule that matches" would have to be considered, rather than just having a simple `PMap.find`.