AssetReader.listAssets might be leaking details that won't work for some builds

[natebosch]

When running a build step in the root package the listAssets api is able to glob stuff outside the root directory, even when it's writing to a file under lib/. This will appear to work fine, but then if this package is published and the builder needs to run (it's a build_to: cache builder) during some build for a different root package it will start failing because none of the assets outside of lib/ are available.

As a package author I could think everything is fine and my builds will work, but when I publish my package it won't work for my customers.

Ideally we should make build_to: cache actions not see any files outside of lib/ when the primary input is in lib/.

[natebosch]

The new "meta module" builder might need this...

[davidmorgan]

Closing as stale.