Not sure this is 100% the right approach. If a subflow module has a dependency
it should be in the subflow's package.json and therefore installed next to the
subflow module in ~/.node-red/node_modules.
By treating it as a 'normal' external module, it will be dynamically installed
in ~/.node-red/externalModules. That then exposes the module to the user
who won't know why its there and may remove it.
It would be better to allow nodes inside a subflow module to require
from ~/.node-red/node_modules and not limit it to the externalModules
dir. The hard part is knowing when to do that.