Add CI check to ensure lockfiles up to date

[zpao]

It's too easy to update a package.json (eg editing on github) without the accompanying lockfile getting updated.