Package using an explicit allowlist

[lloeki]

Minor: I know this wasn't like this before, but I wonder if we should move to an allow-list instead, e.g. only package what we need, rather than excluding what we don't need

Originally posted by @ivoanjo in #37 (comment)