pin `npm` versions with volta

[alxndrsn]

Note

This is for consideration - not 100% clear yet if it's a good idea.

Pros

1. ensure consistent experience across environments (maybe this is already true from pinning node?)
2. allow updating of npm version independent of node version

Cons

• one more thing to keep up-to-date
• will need to be done separately in central/service.dockerfile, as volta is not used there

[matthew-white]

CC @lognaturel, who's thought a lot about what we should pin and at what level vs. what we don't need to pin.