Use `yarn install --frozen-lockfile` for CI

https://yarnpkg.com/en/docs/cli/install#toc-yarn-install-frozen-lockfile

Basically we are not making sure the lockfile is always up-to-date and the results are consistent across systems. If this is too burdensome as-is then we need to start pinning our dependencies as they are otherwise constantly shifting underneath us and make reproducible builds impossible.