build: use version control lockfile of package dependencies for development

[zimeg]

Summary

This PR uses a version controlled lockfile of package dependencies for development to guard against drift in development and supply chain attacks for #2541 🔏

Notes

• This lockfile is not included with published packages so we are not binding versions with this change:

package-lock.json cannot be published...

🔗 https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json

• We might find @dependabot is more responsive to patch changes for issues such as Please update Axios to 1.15.0 #2549 🤖

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 56ac0d5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.42%. Comparing base (175dcb8) to head (56ac0d5).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2551   +/-   ##
=======================================
  Coverage   87.42%   87.42%           
=======================================
  Files          62       62           
  Lines       10249    10249           
  Branches      415      415           
=======================================
  Hits         8960     8960           
  Misses       1268     1268           
  Partials       21       21           

Flag	Coverage Δ
cli-hooks	87.42% <ø> (ø)
cli-test	87.42% <ø> (ø)
logger	87.42% <ø> (ø)
oauth	87.42% <ø> (ø)
socket-mode	87.42% <ø> (ø)
web-api	87.42% <ø> (ø)
webhook	87.42% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[WilliamBergamin]

Just to confirm we are including this only at the top level, not individual package level? 🙏