Fix CI Dashboard unit testing

[webbnh]

This PR addresses some of the issues that we've seen recently with the Dashboard unit testing in the CI.

In particular, the unit tests were failing with

    Cookie has domain set to the public suffix "localhost" which is a special use domain. To allow this, configure your CookieJar with {allowSpecialUseDomain:true, rejectPublicSuffixes: false}.

      at Object.getPublicSuffix (node_modules/tough-cookie/lib/pubsuffix-psl.js:62:11)
      at permuteDomain (node_modules/tough-cookie/lib/permuteDomain.js:38:28)
      at MemoryCookieStore.findCookies (node_modules/tough-cookie/lib/memstore.js:99:21)
      at MemoryCookieStore.findCookies (node_modules/universalify/index.js:5:67)
      at CookieJar.getCookies (node_modules/tough-cookie/lib/cookie.js:1407:11)
      at CookieJar.getCookies (node_modules/universalify/index.js:5:67)
      at CookieJar.getCookieString (node_modules/tough-cookie/lib/cookie.js:1452:21)
      at CookieJar.getCookieString (node_modules/universalify/index.js:5:67)
      at CookieJar.getCookieStringSync (node_modules/tough-cookie/lib/cookie.js:1723:21)
      at DocumentImpl.get cookie [as cookie] (node_modules/jsdom/lib/jsdom/living/nodes/Document-impl.js:860:28)

which was the result of a breaking change to the tough-cookie component. tough-cookie is not used by the Dashboard; rather, it's a dependency of a dependency of Jest which we use for Dashboard unit testing.

This PR makes three changes:

• Add an explicit (development) dependency on tough-cookie v4.1.2 (the breakage was introduced in v4.1.0, and v4.1.1 was a failed attempt to fix it); without the explicit dependency, we seem to still pick up v4.1.0.
• Add a command to the build script to remove the node_modules directory, to ensure that we pick up a fresh installation of our dependencies. (There are other ways to accomplish this (such as the npm commands, clean-install and ci), but without a version-controlled package-lock.json file, they all present problems, so we'll just brute-force it for now.) Also, since it's not currently version-controlled, remove the package-lock.json file, so that we generate a fresh set of dependencies on each build.
• Remove the dependency on nvm. It pulls a very old version of the manager, and we don't seem to actually need it (at least, as a production dependency...).

[dbutenhof]

Someone created, and someone else used, a package called "tough-cookie". (Sigh.)

[dbutenhof]

Oh, and... we really ought to be tracking all our work with Jira issues.