App Engine needs the whitelist file and it's cleaner if it's in its own package where it can be imported directly, without pushing composite.go through a pile of sed. R=dsymonds, r CC=golang-dev https://golang.org/cl/12746045
