chore(ci): prevent publishing invalid SRIs

[WilcoFiers]

An SRI is essentially a hash of axe.js. As of version 3.1 (I think) , we are bundling a few external dependencies into axe-core. This hash is created when we create the release branch, and put into sri-history.json. If any of the dependencies is different when we build locally for the release branch, from when we build in CI right before executing npm publish, axe-core will not be identical, and the SRI in sri-history.json will be incorrect.

To fix this, this PR does:

1. add a package-lock file, and use npm ci to ensure the server build has the dependencies in the lock file
2. make npm ci part of the npm run release script, to ensure dependencies are in sync with package-lock
3. Add npm run sri-validate before releasing to test the sri matches what is in sri-history.json

Reviewer checks

Required fields, to be filled out by PR reviewer(s)

• Follows the commit message policy, appropriate for next version
• Code is reviewed for security

[stephenmathieson]

It's not clear why this fixes anything with SRIs. Please include documentation for this change.

updated

[straker]

We should merge #2041 first so the sri-validate can work locally

[straker]

Nm, won't work anyway. merge away