CI: make the ci fail if npm files are out of sync

Context

npm install seems to ignore (and rewrite) the package-lock.json lock file if it disagrees with package.json.

npm ci is like npm install but gives stronger garanties and fails if package-lock.json cannot be respected.

Manually testing the MR

• Triggered a pipeline with the first commit only and see the CI fail
• Bumped the npm constraint and see the CI pass

Checklist

• Document the interface of any function added or modified (see the coding guidelines)
• Document any change to the user interface, including configuration parameters (see node configuration)
• Provide automatic testing (see the testing guide).
• For new features and bug fixes, add an item in the appropriate changelog (docs/protocols/alpha.rst for the protocol and the environment, CHANGES.rst at the root of the repository for everything else).
• Select suitable reviewers using the Reviewers field below.
• Select as Assignee the next person who should take action on that MR