pin dependencies

[raboof]

we should probably consider pinning dependencies, meaning:

• create a package-lock.json with the pinned dependencies
• have some CI to automatically update it
• have some process to deploy those updates
• change npm install to npm ci where applicable

[ppkarwasz]

We could also convince the upstream to do it.