mimics the duplication of strings in `Builder` for `Pkg`. This
ensures the lifetime of the memory backing strings in a `Pkg`
struct and the `Pkg.dependencies` slice is not shorter than the
`Builder` that the data is associated with.