We need to commit `package-lock.json` to repository to ensure reproducible builds. This also starts using [`npm ci`](https://docs.npmjs.com/cli/ci.html) to install dependencies. Drive-by: remove non-functioning `rebase` workflow.
