Dedupe unhoisted node_modules using package-based hashing

[mischnic]

↪️ Pull Request

Essentially a rebase of #4981

Don't use resolveResult.filePath for hashing, but pkgName@pkgVersion/relativePath inside node_modules.

Do we actually want this (by default)?

• This system also applies to local monorepo packages
• Would deduplicate cases where Yarn wasn't able to do it (smaller bundles)
• patch-package has to be considered

TODO

• Add test
• factor input contents into cache key?
  • currently only with isSource: false
  • this might have some consequences for HMR which relies on stable asset ids
• cascading bundle invalidation (and/or changing package versions might change asset ids but not content)
  • don't make this the actual (asset) id, only use for deduplicating asset group ids
• it currently just uses the nearest package.json, not the "root" package.json of the package. so there can potentially be some un-deduplicated packages (with the case of having a sub-package.json for specifying some main/module/... variants)
  • the failing tests are asserting this
• One potential (likely but untested): it's not deterministic which of the asset paths is chosen when deduplicating (e.g. whether /node_modules/duplicated/index.js or /node_modules/foo/node_modules/duplicated/index.js wins)