Add a `forceRebuild` flag to `library.get`.

`library.get` now takes an options object instead of a single second
boolean `throwOnError` argument. I think I got all the call sites...
Keep track of package sources as we build
Create package source tarball from actual source files.

* Get the source files by getting a package from the library with
  'forceRebuild'.
* Add an option to files.cp_r for whitelisting particular files to copy.