Therefore, my firmware loading happens in a base class in which I don't want to include "ros/package.h"
you don't need to.
My recommendation: provided your base class / functionality has some sort of load_firmware_file(std::string& filename) method, just use ROS parameters to store an absolute path on the parameter server (set those in your launch file fi: $(find pkg_name)/path/to/firmware/file.bin).
Then use NodeHandle::getParam(..) (or one of the alternatives) to retrieve the parameter, if necessary massage it a bit, and call load_firmware_file(filename_from_ros_parameter_server).
The binary file itself can be included with your package. You could place it in the root of the pkg, or somewhere else. Doesn't matter, as long as your launch file sets the correct path in the ROS parameter.
As to installation: use install (FILES your/firmware/file.bin ${CATKIN_PACKAGE_SHARE_DESTINATION}) (docs). That way the file ends up in /opt/ros/$distro/share/pkg_name and will be easily find()able by launch files.
Edit:
Regarding the install() option, how could I find the installed file during runtime directly from the base class, without using find() or another ros tool?
Personally I wouldn't have an option with still using ROS parameters for this (is flexible and makes the name of the firmware file configurable, which can be a big plus), but if you really don't want to: place the firmware file in the same location as in my previous answer, but instead of ROS parameters in your launch file, use ros::package::getPath(..) as you already mentioned. That should give you the path to the share/$pkg dir in the same way as the $(find ..) substitution arg does.
From there the approaches are identical.
