proposal: Pin npm package versions

[jmooring]

Motivation and justification: #3361 (comment)

We can either do this in package.json (which makes intentional dependencies a bit of a hassle), or add package-lock.json to source control if we can make Netlify run npm ci (which looks a bit of a hack):

https://answers.netlify.com/t/how-can-i-use-npm-ci-instead-of-npm-install/12570/14

[bep]

Yea, that sounds smart.

• I suggest that we do this for dependencies only (not Tailwind etc.)
• And that we as part of this do a refresh (except Turbo, keep that at 8.0.20 for now)