cmsBuild: fix handling of subpackages

fix the handling of subpackages in various parts of cmsBuild:
  - expand subpackages in dependencies
  - set the subpackage checksum consistently
  - do not try to build a subpackage, as building the main package should take care of that

note that I'm not handling a subpackage hash explicitly - it seems to work without needing that, because a subpackage shares the same hash and version with its main package