ci: ensure npm ci does not dirty package-lock via npm-force-resolutions

[hkang1]

Description

There are security vulnerabilities that are sometimes discovered in npm packages that are dependencies of dependencies which we do not directly control. To overcome this limitation, we us npm-force-resolutions and the resolutions field under package.json to forcibly resolve the packages to use the proper dependencies that resolved the security vulnerabilities. The problem is that the resolution process should only occur during the package installation step (npm install) but NOT during CI gathering of dependencies (npm ci). Currently it occurs in both. This PR uses a postshrinkwrap script to run npm-force-resolutions, which only occurs for npm install and not npm ci.

@hamidzr discovered this post that provides basis of this solution:
rogeriochaves/npm-force-resolutions#10 (comment)

Test Plan

Check that...

1. npm ci does not alter any files, especially package.json and package-lock.json.
2. npm install does run npx npm-force-resolutions (postshrinkwrap script).

Commentary (optional)

[hamidzr]

Thanks!