Add js lock file commands

[tmorrell]

❤️ Thank you for your contribution!

Description

This PR builds off of some commits in #390

At the moment, invenio-cli will wipe and recreate all js assets when runming the invenio-cli install command. This isn't the most safe thing to do in a world of package compromises. This PR attempts to recommend a new workflow, where a command invenio-cli assets lock will create a packages.json and package-lock.json`, which can be committed into a repository. Then the assets build commands use those locked dependencies when reinstalling. This makes the js behavior more similar to how the python behavior works (respecting a lock file), without changing the default if a lock file isn't present.

I haven't tested on pnpm, though support should be included.

Checklist

Ticks in all boxes and 🟢 on all GitHub actions status checks are required to merge:

• I'm aware of the code of conduct.
• I've created logical separate commits and followed the commit message format.
• I've added relevant test cases.
• I've added relevant documentation.
• I've marked translation strings.
• I've identified the copyright holder(s) and updated copyright headers for touched files (>15 lines contributions).
• I've NOT included third-party code (copy/pasted source code or new dependencies).
  • If you have added third-party code (copy/pasted or new dependencies), please reach out to an architect on Discord.

Frontend

• I've followed the CSS/JS and React guidelines.
• I've followed the web accessibility guidelines.
• I've followed the user interface guidelines.

Reminder

By using GitHub, you have already agreed to the GitHub’s Terms of Service including that:

1. You license your contribution under the same terms as the current repository’s license.
2. You agree that you have the right to license your contribution under the current repository’s license.

[tmorrell]

Closing and re-opening for CI

[tmorrell]

I think this is now fully ready and I've addressed all comments. If someone wants to approve I can get this out.