Update the code for listing the files that would go into the npm package.
npm-packlist v7 removed the internal logic for using Arborist and instead
requires the caller to do this instead. The new code follows the current example
in the npm-packlist README [1].

This unfortunately means adding an extra dependency. An alternative approach
would be to invoke `npm package` to generate a tarball, then unpack that tarball
somewhere and read its contents using file system APIs.

[1] https://github.com/npm/npm-packlist#npm-packlist