Fix updating lockfile in dependabot PRs

Currently, there is an issue in PRs opened by dependabot

• when a dependency is updated in package.json, the change is not reflected in the package-lock.json - merging such PRs may be dangerous as the CI is not actually running with the updated version of the dependency
• PRs updating only dependencies listed in the package-lock.json file look correct

clone of #https://github.com/patternfly/react-component-groups/issues/557

まず Dependabot PR の package.json と package-lock.json を比較し、次にリポジトリの Dependabot と CI の設定を調べて、依存関係の更新がどのように生成および検証されるかを追跡します。package.json の依存関係の更新が package-lock.json に反映され、更新された依存関係で CI が実行される一方で、lockfile-only の更新も引き続き正しい状態であることが完了の条件です。