Rewrite _xxx_pkg_metalog() to deduplicate METALOG entries and split
the target database regeneration into _xxx_run_pkg_scripts(). Fetch
pkgbase packages into a local repo before installing.

Add metalog_add_data() to append a metalog line for a file or
directory with sensible mode defaults, and use it throughout instead
of hand written entries.

tgt_pkg fetch intermittently fetched only a subset of the packages.
Use tgt_pkg install -F instead, and remove the stale target pkg
database before a clean build.

Fix the pwd_mkdb and cap_mkdb invocations in _xxx_run_pkg_scripts(),
and run certctl rehash to regenerate the trusted cert bundle.