[rush] Use `--prefer-frozen-lockfile` in `rush update` (without `--full`)

[dmichon-msft]

Summary

When running rush update, I expect it to only change the lockfile if necessary to satisfy new constraints from rush.json, package.json, pnpmfile.js, or common-versions.json.

However, the current command runs pnpm install --no-prefer-frozen-lockfile, which is a bit more permissive of lockfile updates.

Repro steps

Pull latest main branch of a Rush monorepo, run rush update

Expected result:
No changes detected, lockfile remains the same and does equivalent of rush install

Actual result:
Updates made to pnpm-lock.yaml and repo-state.json

Details

Change --no-prefer-frozen-lockfile to --prefer-frozen-lockfile, at least for pnpm >= 5 on workspaces, or just behind an experiment/pnpm config setting.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.40.3
rushVersion from rush.json?	5.40.3
useWorkspaces from rush.json?	true
Operating system?	Linux
Would you consider contributing a PR?	Yes
Node.js version (node -v)?	10.24.0

[D4N14L]

Looking into the issue specified in the code relating to this switch:

rushstack/apps/rush-lib/src/logic/base/BaseInstallManager.ts

Line 507 in c4d6540

// See this GitHub issue: https://github.com/pnpm/pnpm/issues/1342

it seems like this option was only required to avoid issues with local tarball hashes. Since local tarballs are no longer used in workspaces, it seems like it would be a good idea to pass --prefer-frozen-lockfile in order to minimize pnpm-lock.yml churn.

The only thing I can think of being affected by this would be how PNPM deals with changes in pnpmfile/common-versions.json. However, we recommend that a rush update --full is provided in this scenario anyway, which means that this switch would have no effect. Additionally when using workspaces, the pnpmfile is used to shim in the common-versions, so really the question we're trying to answer is if this integrity hash issue is dealt with when changes are made in pnpmfile. Given the fact that --prefer-frozen-lockfile is true by default, and that the only reason we disabled it was to support a Rush-specific local tarball installation, I'm thinking that we should be good to use the PNPM default. Though @zkochan may have some input here :)