package-lock.json checked in, but CI uses yarn

[tkallage]

This package uses a package-lock.json file as its lockfile. The CI pipeline however uses yarn to install the dependencies which does not respect this lockfile. As a result, the CI pipeline is currently failing as yarn uses a newer version of glob that does not support the node version used in the ci image (10).