Figure out the way to test different deps than the locked ones

[stof]

As this package is used as a library by others, we have no guarantee that they will install dependencies being exactly the same than our locked deps.
So it would be great to have some CI job resolving deps separately from the lock.

We need to figure out what the Node.js best practices around that are, and apply them on our CI.

[steven-pribilinskiy]

We could support npm and yarn by running both npm install and yarn add whenever a new package is added.
Unfortunately there's no guarantee that package-lock.json and yarn.lock will be equivalent. It's because some dependencies may commit package-lock.json and others yarn.lock

Unfortunately the package-lock.json file from NPM@5 is not supported by yarn
yarnpkg/yarn#3614

[stof]

@pribilinskiy I don't care about supporting both NPM and Yarn for people contributing to this project (people using this project are already free to use what they want).
This issue is about figuring out what the Node best practices are regarding versions of deps used on CI for libraries.
The lock file is a root-only thing anyway (like in composer).