`shims`: Bundle external dependencies into `endoify.mjs`

[rekmarks]

As a consequence of #8, extension has to statically copy dependencies of endoify.mjs into its build output directory. We should instead bundle those dependencies into endoify.mjs itself, even if that's just concatenating the the sources in the correct order (considering that we need to avoid destructively transforming ses, lockdown, and eventual-send).

[rekmarks]

To clarify, the reason that we need to do all of this is because the action of many bundlers / minifiers (including vite) may act destructively upon ses and lockdown, thereby destroying their security properties. In theory, we could review all of the transforms of our chosen bundler and convince ourselves that the security properties are preserved, but we are not going to do that. Instead, we will simply ensure that these dependencies remain un-transformed at runtime.

[grypez]

Issue current status is 'implemented but not tested'. The implementation preference after review --- to avoid the streamcat dependency --- has been met. However, the testing of the code is problematic. The desired behavior --- proper operation of the bundled endoify shim --- is itself confounded by the vitest framework, for reasons which @SMotaal has elaborated upon in standup. That is, no matter how minimally the test is written, merely the act of importing the shim is disrupted by attempting to run vitest as currently setup.

My understanding of the edge of what is known about the disruption is that the AST parser employed by vitest's bundler is unable to parse the contents of the endo code which is in this issue bespokely bundled into dist/endoify.js. In particular vitest's AST parser takes objection to the ZWJ (zero width joiner) characters used by the endo codebase to construct probably unique names in a context in which very little is known about the bound names which may be found in the same context. In a certain sense, this has worked splendidly, because the names are so unlikely to appear in javascript code that vitest does not even recognize them as valid javascript.