[JS] Failed to lock package's version in release tool

# Problem

Currently, there's no lock for indirect dependent packages (e.g. we depend on `packageA`, and `packageA` depend on `packageB`, then `packageB` is the indirect packages). If the indirect packages has update to cause failure for us.

# Solution

Fix the version used in js release tool

# Proposal

1. Add `package.json` under .scripts, with a dependency on `@azure-tools/js-sdk-release-tools`. I recommend pinning the version and using dependabot to update it in dedicated PRs.
1. Run npm install to generate `package-lock.json`.
1. Change `automation_init.sh` to run npm ci, which guarantees the package and transitive deps are locked, until they are updated by a dependabot PR.

# Related Issues For Indirect Packages
1. https://github.com/isaacs/minimatch/issues/259
2. https://github.com/isaacs/node-glob/issues/627

Start by inspecting automation_init.sh and the .scripts directory, then review how the JS release tool is currently installed. Add the proposed package manifest and generated lockfile, change the setup command from npm install to npm ci, and verify that the release tool and its indirect dependencies are installed from the lockfile.

Written by the indexing model from the issue text.