adds missing package lock for reproductible CI

[baywet]

fixes#3556

[baywet]

Note: the schema test will fail until we merge to main since there currently isn't any package-lock.json on main

[lornajane]

How does this change affect people running the checks locally?

[baywet]

when you install locally, you'll get the same exact versions that were installed when this file was setup (or whenever a dependabot update was merged). It improves reproducibility

[baywet]

on the first pull after this gets merged however, you might have git complaining that you already have a package-lock.json if you've already ran npm i. Just delete it. That's a one time problem affecting people who installed before this PR.
People familiar with git and/or npm should be able to resolve that on their own without requiring assistance.

[handrews]

Looks good to me. You'll need to make PRs copying the schema-tests.yaml workflow out to the v3.0.4-dev, v3.1.1-dev, and v3.2.0-dev (like PRs #3560, #3561, and #3562).

[handrews]

After some discussion last week, this sort of limited-impact change (most of our checks are failing right now anyway) can be merged with one approval, so I'm doing that.