Remove mason-js dependency

The mason-js dependency is unmaintained and frozen, but still currently used inside of vtcomposite. It has been unmaintained since 2018. For a while it seemed like mason-js would again see maintenance (enough that security issues related to out-of-date binaries and mason-js JS dependencies could be mitigated). But, in effect, mason-js not been maintained since 2018 and therefore I think it is critical to acknowledge this and take action downstream (here).

So, my recommendation is to remove the dependence on mason-js in vtcomposite.

To do this would involve:

• Removing mason-js from https://github.com/mapbox/vtcomposite/blob/ffdea5a7749fb784fbcf8122e2a4c89e725bd777/package.json#L20
• Removing the mason-versions.ini
• Implementing an alternative method for fetching up to date and reliable versions of dependencies that are currently being installed by mason-js

Start with package.json at the referenced dependency entry and mason-versions.ini, then trace how vtcomposite currently uses mason-js to install dependencies. Identify a maintained replacement for fetching reliable dependency versions. Done means mason-js and mason-versions.ini are removed and dependency fetching works through the replacement.