use ycb-based tokens like $$lib$$ instead of repeating subpaths

requires ycb@1.0.5; previously only the first token would be
replaced.
update ycb & arrow dependencies for new multi-token descriptor usage
Merge pull request #1104 from isao/descriptors

use ycb-based tokens like $$lib$$ instead of repeating subpaths