Extract npx lockfile-lint --path package-lock.json from test workflow

[babblebey]

          for the other repos with more recent changes, we've moved this into the scripts in `package.json` that end up getting called from `npm t`

this changeset is a good reference for the group of changes that are related to what i'm highlighting here. i would also be ok with these changes being a follow-up to this PR, but the changes you are making in this PR set us up for those changes to make sense whichever way you decide is best

Originally posted by @travi in #411 (comment)