Don’t leak full path to source in deduped deps

Fixes #951.

When `fullPaths` is `false`, the important part of the implicit dependency is `row.dedupeIndex`, which must be set as a value in `row.deps`. The key doesn't actually matter, so I chose `dup` because it's short and descriptive enough.

When `fullPaths` is `true`, these dependencies between deduplicated source and original source are already tracked.

This fixes #951 because `row.dedupe` contained the full path to the original source file and it was being used as the key in `deps`, which would leak full paths into the output bundle.