Remove ComponentVersions usage from DeploymentTracker

It seems like this was used more out of convenience than necessity. Now we call file_contents on the client directly, using canonical_or_security_path to handle security deployments like other API calls in this class.

This is out of a desire to remove unnecessary coupling between classes.

Extracted from !1059 (merged).