Add --frozen-lockfile to yarn install commands in CI

[rak-phillip]

Summary

This updates yarn install usage to enforce --frozen-lockfile across all yarn and yarn install commands.

Occurred changes and/or fixed issues

• Add --frozen-lockfile to yarn install commands in CI
• Add --frozen-lockfile to bare yarn commands
• Change --pure-lockfile to --frozen-lockfile

Technical notes summary

--frozen-lockfile makes installs deterministic by ensuring that yarn installs the exact dependency versions already defined in yarn.lock. If the lockfile is out of sync with package.json, the install fails immediately instead of silently re-resolving dependencies or mutating the lockfile.

Areas or cases that should be tested

CI should pass without failure.

Areas which could experience regressions

There are some scripts that have been altered, mostly related to extension builds and tooling. I'm not sure if we need to change these files, but if they are run in CI in any way, the answer is yes: the aim of this PR is to prevent accidental lockfile updates during CI runs and to ensure that every pipeline execution installs the same dependency graph.

Screenshot/Video

NA

Checklist

• The PR is linked to an issue and the linked issue has a Milestone, or no issue is needed
• The PR has a Milestone
• The PR template has been filled out
• The PR has been self reviewed
• The PR has a reviewer assigned
• The PR has automated tests or clear instructions for manual tests and the linked issue has appropriate QA labels, or tests are not needed
• The PR has reviewed with UX and tested in light and dark mode, or there are no UX changes
• The PR has been reviewed in terms of Accessibility
• The PR has considered, and if applicable tested with, the three Global Roles Admin, Standard User and User Base

[rak-phillip]

This change isn't needed. It's just a command for developers.

[richard-cox]

Looking at the docs https://classic.yarnpkg.com/en/docs/cli/install#toc-yarn-install... they're bad.

From what i can tell neither modify the lock file (yarnpkg/yarn#5847 (comment)), however pure-lockfile will still install package.json ranges whilst frozen-lockfile exits with a failure.

In both cases we should avoid the package.json overriding the lock, so frozen-lockfile seems a good choice (even if it will lead to lots of failures)