Move tarsum to pkg/

Pretty straightforward, no logic changes.
Anything that's in `pkg/` should not reference outside packages especially not utils.