[Bug]: js_binary data deps seem to linger

### What happened?

If I have a `js_binary` and set something from `//:node_modules` as a `data` attribute, a copy of the node_modules still exists in `bin` even if I subsequently remove it from the `data` attribute; this in turn means the binary still runs even though it probably shouldn't.

### Version

Development (host) and target OS/architectures: Mac

Output of `bazel --version`: bazel 5.3.2

Version of the Aspect rules, or other relevant rules from your
`WORKSPACE` or `MODULE.bazel` file: 1.6.9

Language(s) and/or frameworks involved: JavaScript.

### How to reproduce

```shell
js_binary(
name = "server",
data = [
# "//:node_modules/express"
],
entry_point = ":server.js",
)
```

server.js can be as simple as:
```js
const express = require('express');
```

### Any other information?

If you run with express commented out, it will fail to run. Then if you uncomment express in `data`, all is right with the world and it runs. However, if you run it again with express `dep` commented out again, express won't be in the server.sh.runfiles, but because there's a copy of the node_modules in the root of bin the `js_binary` will run unless you `bazel clean` first.

Start by reproducing the issue with the provided js_binary and server.js example, first with express removed from data and then with it added and removed again. Inspect js_binary's output and runfiles handling, comparing server.sh.runfiles and the copy under bin; done means the stale node_modules copy is removed without requiring bazel clean.

Written by the indexing model from the issue text.