Problem

In light of recent npm supply chain attacks we should make sure our defaults results fully reproducible dependency chains. Currently, we recommend npm install and have no package-lock.json.

Proposed solution

Update where we run npm install to make use of npm ci and ensure a package-lock.json that has been pre-validated and is included in the commit history.

Context

Coming from #5423 (comment)