one-time content scan. Addresses Issue #223.

This addresses two cases: files that change during a slow bundle (eg, during
slow NPM updates) and *do* end up with a different mtime (which could also be
addressed in other ways, see eg the issue-223-dead-end branch)... and those that
change twice within the same second on OSX HFS+ which only has 1-second mtime
resolution, which really cannot be addressed in any purely mtime-based way.

This still is not 100% perfect. Most notably, any files read via
register_extension (which is to say, basically all source files other than
package.js and static resources) still have a race between hash calculation and
the actual read done by the bundler, since the register_extension API takes a
source_path rather than contents. This could be addressed by making
register_extension handlers take the contents as an argument too (and encourage
the use of source_file only for things like printing errors with filenames, not
actually for reading the file). In addition, this won't detect files added after
the bundler passes them but before the initial DependencyWatcher run.