Move generate-images dependencies to package.json

[silverwind]

Fixes: #30685

I consider it fixed because npm i --no-save with lockfile should be fully reproducible, faster and have less bugs than npm ci, unless someone proves me wrong.

[pboguslawski]

According to the npm manual --no-save only prevents saving to dependencies (doesn't say nothing about installation of versions locked with checksums). So it's not designed for reproducible builds problably. See more opinions about using npm ci for reliable builds.

[silverwind]

The important part of no-save is "Will also prevent writing to package-lock.json if set to false.", so it will reproduce a node_modules a bit less strict than npm ci but it's not a issue because we validate our lockfile is consistent on CI.

[silverwind]

That said, I'm leaving it open for the future to run npm ci for example when build is in MAKECMDGOALS, which would kind of be an extra reinforcement during the build.

[silverwind]

On topic of this PR, I'm still unsure if it's really worth the trouble to expose us to build failures of the canvas module. #30596 (comment) says removing --no-package-lock solved the issue and we have that already removed on main branch since a while, so I think I'm leaning towards leaving it at that and closing this PR.

[silverwind]

Closing, I'll take another approach with separate lockfile.