filter third_party and internal packages out of search

filters from search results, but still visible when browsing an index of packages or when accessed directly.

ref #169

Minor, but would `isExcludedPath` (or `isValidPath` akin to [`IsValidRemotePath`](https://github.com/golang/gddo/blob/0cc83381c232c327b233adc93131daab85f36264/gosrc/path.go#L482)) be better?