[Bug] `package-lock.yml` has different hashes when `--add-package` is used or not

### Is this a new bug in dbt-core?

- [X] I believe this is a new bug in dbt-core
- [X] I have searched the existing issues, and I could not find an existing issue for this bug

### Current Behavior

When adding a new package to dbt using:
```sh
dbt deps --add-package @
```
the package-lock.yml gets updated with a new sha1. However, if one runs:
```sh
dbt deps
```
afterwards, the sha1 gets a new value.

### Expected Behavior

When running:
```sh
dbt deps
```
afterwards, the sha1-hash should remain unchanged. The sha1-hash produced from running:
```sh
dbt deps --add-package @
```
should be consistent and sufficient.

### Steps To Reproduce

Step 1: Set up dbt-core
```sh
python -m venv .venv && source .venv/bin/activate
pip install --upgrade pip && pip install dbt-core==1.8.8
dbt init dbt_project; cd dbt_project # ignoring "No adapters available" error
```

Step 2: Install dbt package
```sh
dbt deps --add-package dbt-labs/dbt_utils@1.3.0
cat package-lock.yml
# packages:
# - package: dbt-labs/dbt_utils
# version: 1.3.0
# sha1_hash: 9c30241ae29a43cdbf99a3398f49bf74568f2d54
```

Step 3: Run dbt deps
```sh
dbt deps
cat package-lock.yml
# packages:
# - package: dbt-labs/dbt_utils
# version: 1.3.0
# sha1_hash: 226ae69cdfbc9367e2aa2c472b01f99dbce11de0
```
Notice the new sha1_hash.

### Relevant log output

_No response_

### Environment

```markdown
- OS: Ubuntu 22.04
- Python: 3.11.1
- dbt: 1.8.8
```

### Which database adapter are you using with dbt?

_No response_

### Additional Context

_No response_