Switch to npm ci

[denis-sokolov]

npm install is somewhat meant for interactive runs. Here are some reasons to avoid it:

• it runs a developer-focused audit by default, and while we can disable the audit (Disable npm audit in npm install #509), there may be more similar features running in the background now or in the future;
• it is not always meant to be deterministic in a way one would expect from an automated deployment, resulting in unexpected behavior for our users (npm ci support #172, forum topic);
• is difficult to cache correctly, resulting in stale cache and breakages (treat package-lock.json the same way we treat package.json if checksum changes #113, Add an option to skip caching node_modules #165, Fix npm caching issues #510);

npm ci is meant for automated deployments and does not suffer from the same issues. Instead, it manages its own cache (#511) and ensures a deterministic result.

It still is slower than an npm install under ideal conditions, but it might be less of a concern than previously expected. With the npm cache (#511), an npm ci on a mid-size project on a laptop takes 7-8s for me as opposed to 2-3s for npm install. The command also runs offline, retrieving all packages from the cache.

This PR might be breaking for some user-provided NPM_FLAGS. As npm ci does not take any options, we may be disabling some functionality users expected. An overview of the existing npm install options brings these, probably unlikely, cases:

• Users with --dry-run and package-lock.json will suddenly have their dependencies installed. Assuming they also install their dependencies themselves in a separate step, this will not impact their build success, but will slow it down by adding duplicate effort;
• Users with --no-package-lock will get older versions of dependencies than they expect, likely breaking their builds;
• Users with --omit will get more dependencies than they expect, probably not impacting their build success, but slowing it down;
• Users with --ignore-scripts may have their builds slow down or possibly break.

Closes #113, #114, #165, #172, #509, #510, #511.

[kitop]

Closing this PR as it's against xenial branch and the Xenial image is going to be deprecated: https://answers.netlify.com/t/please-read-end-of-support-for-xenial-build-image-everything-you-need-to-know/68239

Feel free to reopen against focal.