It should be possible for a module to automatically have read permission to some or all of its imported packages granted to it.

Some outstanding questions:

• Do we need an equiv to "open" packages, to selectively exclude readability?
• Do we allow non-package paths to be readable by default?

Services are handled by "data" URLs now, but resources such as configuration or bundled entities are not.