[npm] reproducible builds

[laemtl]

Prevent package-lock.json to be automatically regenerated with npm install to have more stable builds.

• enable package-lock.json tracking (recommended practice)
• replace npm install with npm ci to achieve fast and reproducible builds
• strict packages versions from package-lock.json are now used for install. To propagate a change made into package.json, run npm install and commit the new package-lock.json.
• any version disagrement between package.json and package-lock.json will trigger an error.

[driusan]

Can you rebase? I just want to be sure it still passes after I just merged the 24.1->main PR.