fix: match npm install semantics by default

[Bubblyworld]

Changes behaviour with existing locks to match npm by default (i.e. if other install flags like freeze aren't set). The only difference is how we handle secondary locks: if they're in range for their parent package.json, we now use the lock, and if they're out of range we reset them to latest compatible, which is what npm does in these cases.

[Bubblyworld]

Note that these lock changes also affect non-install operations, which again matches npm's behaviour.