(cdk cli modules): change dependency specification or packaging to fix the dependencies for a given CLI version

### Description

The fix for the colors.js and faker.js sabotage fixes the issue by [fixing those package version numbers to a fixed version](https://github.com/aws/aws-cdk/commit/b851bc340ce0aeb0f6b99c6f54bceda892bfad0e).

However all other packages are still using a caret version range. So the cdk CLI is still vulnerable to accidental or malicious breaking changes to other packages.

The best practice would be that the dependency version for a given version of the CLI are completely fixed, so that you have repeatable builds. I see that npm has [npm ci](https://docs.npmjs.com/cli/v8/commands/npm-ci) and `package-lock.json` to allow for the dependency closure for an npm package to be deterministically specified, but I'm not sure that's suitable for your purposes.

Given how the cdk is currently distributed, I'm not sure there's an easy answer. I don't think that `npm install` can ever give repeatable builds, because even if all versions are fixed in `package.json`, the depended upon packages may have range dependencies themselves.

However, I think this is a problem the cdk needs to solve, and I suspect you'll need to change how the cdk is distributed to do so. As long as this is unsolved, the cdk is vulnerable to dependency/supply chain attacks, and the next one could be more malicious than the colors.js and faker.js breakage.

### Use Case

To prevent accidental or malicious changes to cdk dependencies from at best breaking my ability to use the cdk command line, and at worst adding malicious functionality.

### Proposed Solution

I'm not sure. However I think distribution via `npm` may not be able to provide a fixed set of dependencies.

### Other information

I call this potentially breaking because changing the distribution mechanism for the cdk CLI would be breaking.

### Acknowledge

- [ ] I may be able to implement this feature request
- [X] This feature might incur a breaking change

Start by reviewing the CLI package.json and package-lock.json alongside the npm ci and npm install behavior described in the issue. Determine whether the current npm distribution can provide a repeatable dependency closure for each CLI version, and document the distribution change required to prevent dependency drift.

Written by the indexing model from the issue text.