Policy scope fix

This fixes a case where repeated scope lookup for modules with multiple dependencies would fail and the manifest would look up the dependency redirector of the referrer rather than the scope. This was found in stress testing of https://github.com/bmeck/local-fs-https-imports . The reason it didn't appear to have a test before is likely that code coverage was unaffected.