Packages that ship unbundled source fail with a dependency cycle

Managing a package that ships unbundled source rather than pre-bundled `dist` files fails the build:

```ts
cosPlugin({ packages: [/^svelte(\/|$)/] })
```

```
[cos] dependency cycle between managed packages:
svelte/src/legacy/legacy-client.js -> …/reactivity/sources.js -> …/proxy.js
-> …/dev/tracing.js -> …/runtime.js -> …/reactivity/effects.js
-> …/dom/operations.js -> …/reactivity/batch.js -> …/reactivity/effects.js
```

`cos-externalise-deps` externalizes every import that has an importer, including relative ones, so the unit of chunking is the resolved **module**, not the package. Svelte's internals import each other circularly (`effects.js` ↔ `batch.js`), and a cycle can't be hashed bottom-up.

I looked at it in https://github.com/danielroe/cross-origin-storage/pull/52, but decided I don't understand it enough to open a PR, so reporting an Issue instead.