dependencies: Hide internals

Created by: efritz

Hide lockfiles and store implementation from outside consumers. The Service struct itself should be what all external consumers interact with directly. Non-internal packages (http/graphql transports and background jobs) will be located outside of the service's internal package.

This is a pre-step to extending the dependencies service with background jobs and its own transport layers.

Please review by commit:

Hopefully review-by-commit will make this short-work for readers. Please pay special attention to the two marked commits as I believe the implementation is in alignment with what was originally wanted, but would like to double-check. I'm happy to respond to readability concerns in that code or the related tests as well.

• 30807f13 Moves the store and lockfiles behind an internal package so that they cannot be imported outside of the dependencies service root.
• 92fb4bd0 Add new methods to the service that delegates to the store. We need to do type wrapping conversions here (unfortunately; for now) because go-mockgen is not playing nicely with the private package + type aliases. I'll file an issue and make sure we can shed some layers here later if we're not doing anything useful with them by that time.
• 0027042e Updates users in a way that is obviously behavior-preserving.
• c58bf5f3 Removes an alias package and its single user.
• 5868a5f5 IMPORTANT Updates go, jvm, and and npm extsvcs to use a dependencies service rather than its store
• 3a559f93 IMPORTANT Update tests in internal/repos to not depend on an actual database
• ... mockgen, chores, responses to feedback, etc

Test plan

Existing unit / integration tests. Tested dependency searches locally and main-dry-run passed.