Remove the dependencyTrackingKey / canonicalizeTrackingKey shim and let
the loader's own canonical identifier form feed the dependency tracker
directly.

The tracker previously keyed module nodes exclusively by http(s) URL:
its canonicalURL guard dropped any non-URL identifier. To bridge that,
the loader carried a dependencyTrackingKey shim that callers crossed
before tracking. That form is no longer needed — the tracker keys nodes
by the loader's canonical identifier: an RRI prefix (`@cardstack/base/X`)
for a mapped realm, the resolved real URL for a plain realm.

Two coordinated changes make direct tracking correct:

- canonicalIdentifier never emits a virtual alias. unresolveURL folds a
  prefix-mapped realm onto its RRI, but the virtual alias of a plain,
  prefix-less realm has no prefix to fold onto and would pass through —
  leaking a virtual URL into dependency lists the index persists as real
  URLs. Any such surviving alias is collapsed to its real URL via
  mapURL('virtual-to-real'), which no-ops on real URLs and RRIs. The
  result is an RRI for prefixed realms and the real URL for plain ones.

- normalizeModuleURL accepts an RRI prefix alongside http(s) URLs,
  stripping the executable extension either way.

card-api tracks identity.module and getKnownConsumedModules deps
directly; the two loader-internal tracking sites use canonicalIdentifier.
Instance and file dependency normalization stay URL-keyed, unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>