[FR]: re-introduce lockfile verification post yarn migration

### Issue
While still using NPM as package manager, the package-lock was validated to not contain localhost as package host.
During Yarn v4 migration (https://github.com/aws-amplify/amplify-data/pull/690), this check has been disabled since there is no `package-lock.json` file anymore.

Reintroduce that check

### Desired Outcome
- there is a script checking the `yarn.lock` for localhost references (because verdaccio)
- the script also checks for correct types (if necessary)
- the script is run as part of PR checks

Review the Yarn v4 migration in pull request #690 and inspect yarn.lock plus the repository's existing PR-check configuration. Identify where the former package-lock validation lived, then define the lockfile checks for localhost references and any required types. Done means the check runs as part of PR checks and rejects invalid yarn.lock content.

Written by the indexing model from the issue text.