fix(publish): keep .git out of the published package

`.gitignore` starts with `.*` and then `!.git*` so that .gitignore, .github and
.gitattributes stay tracked. moon publish reads the same file, and that negation was
enough to pull the entire .git directory into the tarball — object database, index
and reflogs included, which is the whole repository history. moonasgi shipped 303
entries, 224 of them .git; moonorm shipped 850.

A .moonignore now scopes this to publishing: .git/ and the build directories are
excluded there, and .gitignore keeps doing its job for git. It needs its own
negation to be tracked, for the same reason .git* does.

Signed-off-by: Leo Cheng (heke1228) <chengkelfan@qq.com>

Author: Lfan-ke

.gitignore

@@ -1,5 +1,6 @@
 .*
 !.git*
+!.moonignore
 _build/
 target/
 

.moonignore

@@ -0,0 +1,7 @@
+# What `moon publish` must leave out of the package. `.gitignore` keeps `!.git*`
+# so that .gitignore/.github/.gitattributes stay tracked, but that same negation
+# would otherwise pull the whole `.git` directory — object database included —
+# into the published tarball.
+.git/
+_build/
+target/