Move to package-lock since we have no runtime deps anyway

This was previously avoided as for libraries it can hide downstream
issues: a lock here means we don't use the runtime dependencies that
real downstream libraries will end up running.

In our case though, we don't actually have any runtime dependencies at
all, so this is a bit pointless and creates unnecessary fragility.

Author: pimterry

.github/workflows/ci.yml

@@ -20,5 +20,5 @@ jobs:
         with:
           toolchain: stable
 
-      - run: npm install --no-package-lock
+      - run: npm ci
       - run: npm test