all: audit use of `npm install` and pin versions in package.json

[hyangah]

We ask devs to use npm ci for installing dependencies for development instead of npm install.
But in some places, we still do. Clean up documentation and scripts and remove use/mention of npm install.

If necessary, pin all the versions in package.json and work with only known good versions of dependencies.

[gopherbot]

Change https://golang.org/cl/379155 mentions this issue: package.json: pin direct dependencies

[gopherbot]

Change https://golang.org/cl/379154 mentions this issue: docs/contributing.md: encourage npm ci instead of npm install

[gopherbot]

Change https://go.dev/cl/379154 mentions this issue: docs/contributing.md: encourage npm ci instead of npm install

[gopherbot]

Change https://go.dev/cl/379155 mentions this issue: package.json: pin direct dependencies