Move tarsum to pkg/

Pretty straightforward, no logic changes.
@erikh @tiborvass is right, you probably want to use `log` instead of `utils.Debugf`. Packages from pkg shouldn't import `utils`.