* remove and disable package-lock

Using exact versions in package.json has the same effect as lockfiles
without all the troubles the lockfiles bring (different versions of
package manager generating different lockfiles primarily).

Ensured we only use exact versions in package.json and stopped
generation of new lockfiles via .npmrc which is support by both the npm
and yarn package managers.

Fixes: https://github.com/go-gitea/gitea/issues/6967

* enable save-exact