Modify JS supply-chain commands to safer versions

```
✗ ./wormhole-scaffolding/evm/Makefile
  Line 29: Use 'yarn install --frozen-lockfile' to respect lockfile
  > yarn

✗ ./wormhole-scaffolding/sui/Makefile
  Line 16: Use 'yarn install --frozen-lockfile' to respect lockfile
  > yarn
```

Output from https://github.com/asymmetric-research/locked-in
