This reverts commit 75f35e48a8. It is unclear how to add/remove dependencies now.
75f35e48a8
We need to commit `package-lock.json` to repository to ensure reproducible builds. This also starts using [`npm ci`](https://docs.npmjs.com/cli/ci.html) to install dependencies. Drive-by: remove non-functioning `rebase` workflow.
This should fix the checkout problems we're facing. Related discussion: https://github.com/actions/checkout/issues/23
