Why does firebase functions not respect existing lockfiles?

### Related issues

### [REQUIRED] Version info

**node:** v16.20.0

**firebase-functions:** 9.16.0

**firebase-tools:** 12.4.0

**firebase-admin:** 11.8.0

### [REQUIRED] Test case

When I do a `npx firebase deploy`, there seems to be a separate project being created for firebase functions in `.firebase//package.json`. The problem is that the package-lock.json from the root project is not respected, as there are a bunch of packages being added, and the package-lock.json is regenerated from scratch for that project in `.firebase`.

I am actually running in a caveat (at least I believe this is because of that) where a subdependency results in a bug, which only happens on firebase functions, and not on Vercel or anywhere else (as Vercel respects the lockfile and just runs the NextJS server).

I'm wondering if there's any way to make the original lockfile being respected. My way of solving this would be to just use Cloud Run via a Dockerfile which runs `next start`, but I'm really wondering how to make it work with firebase functions and how other people deal with this or if they were just lucky enough to not ever run into a case where a subdependency is slightly different and thus creating issues.

### [REQUIRED] Steps to reproduce

- initialize any firebase project
- see a new package.json created in `.firebase//package.json` without a lockfile, then shorty after a lockfile is created at `.firebase//package-lock.json`.

### [REQUIRED] Expected behavior

No new package.json and lockfile is created and versions are deployed exactly as they are defined in the project root lockfile.

### [REQUIRED] Actual behavior

see above

### Were you able to successfully deploy your functions?

Yes.