[bzlmod] Mark npm extension as reproducible

[dzbarsky]

This stops duplicating all the info from the pnpm lockfile into the Bazel one. Tested by upgrading to Bazel 7.1.1 and bazel test --lockfile_mode=update //.... Lockfile dropped from 79K lines to 4.4K.

There are still some gains to be had from python and go rules also using deterministic node, but that's outside the scope of this PR.

[jbedard]

If we're starting to work on the lockfile maybe we should checkin one that shoes this improvement?

[dzbarsky]

If we're starting to work on the lockfile maybe we should checkin one that shoes this improvement?

I switched the bzlmod example to use updated bazel version and check in the lockfile. Is that fine or do you want a second bzlmod example with lockfile?

[jbedard]

I switched the bzlmod example to use updated bazel version and check in the lockfile. Is that fine or do you want a second bzlmod example with lockfile?

I guess it depends how often it's updated and how annoying/noisy that will be. Any ideas?

[DavidZbarsky-at]

I switched the bzlmod example to use updated bazel version and check in the lockfile. Is that fine or do you want a second bzlmod example with lockfile?

I guess it depends how often it's updated and how annoying/noisy that will be. Any ideas?

There's nothing really enforcing the lockfile is up to date so it will only get updated when a human runs bazel in that workspace and there are dependency changes. (It would be nice to enforce but there are still os/arch-specific lockfile sections so it was annoying for me to match the lockfile to what CI expected)