common permissions

Fixes #339 (closed).

Actually fixes it in two ways. Both by making common dependencies be build dependencies instead of runtime dependencies (was discarded as a solution to #290 (closed) since it wouldn't help with pkg_pretend or pkg_nofetch, but is probably a good idea anyway) and also by making sure that the temporary VDB which was origially set up to solve this problem is actually readable in the sandbox.

I considered doing full tests since this was a rather obscure bug, but making common dependencies build dependencies actually makes it basically impossible to reproduce a similar situation in the test environment (as now common dependencies always get installed first, so the temporary VDB will only be used in pkg_pretend and pkg_nofetch, which are already being tested). I have made sure that we get coverage on all functions called during the installation and removal process though.