[FR]: re-introduce lockfile verification post yarn migration

[bobbor]

Issue

While still using NPM as package manager, the package-lock was validated to not contain localhost as package host.
During Yarn v4 migration (#690), this check has been disabled since there is no package-lock.json file anymore.

Reintroduce that check

Desired Outcome

• there is a script checking the yarn.lock for localhost references (because verdaccio)
• the script also checks for correct types (if necessary)
• the script is run as part of PR checks