feat(permissions): grant relaxed-profile read to imported npm packages
When the relaxed default permission profile is active, loading a module that
lives in a managed npm package grants read on that package's folder, so a
package can read its own bundled data files at runtime without a prompt. The
grant is scoped to packages the program imports and targets the worker's own
permissions.