Bundle dependencies

**NOT INTENDED FOR MERGE**

Does not bundle strong-pm and strong-deploy so that npm has the option
of deduping them with the versions installed by strongloop when
strong-arc is installed as a dependency of strongloop.

This is the most obvious solution for #451, though I don't think it is necessarily the best.