Safer installation with npm of lodestar-cli

**Describe the bug**

Doing
```
npm lodestar-cli
```
is unsafe to dependency attacks, since the yarn.lock is not considered for dependency resolution.

**Expected behavior**

For npm installations, generate a package-lock.json (with https://github.com/imsnif/synp for example) and then generate a shrinkwrap file (see https://docs.npmjs.com/cli/v8/commands/npm-shrinkwrap). The shrinkwrap should take precedence on installation. This generation should happen in CI when publishing.

For yarn installations: investigate

- Related: https://github.com/ChainSafe/lodestar/issues/3470

**TODO**

To reduce the attack surface we should count who many individual authors we rely on and minimize that number and / or ensure we have a sufficient level of confidence towards them.