Add linter for package-lock.json resolved

[silverwind]

If the user is using a npm proxy, the will write its URL into package-lock.json, like it happened in #28571, which may cause issues in the future in case npm ever decides to use of these URLs (currently it doesn't seem to).

Add this linter to ensure all URLs in the files start with https://registry.npmjs.org/.

Example error:

package-lock.json: Expected "resolved" on package node_modules/@aashutoshrathi/word-wrap to start with "https://registry.npmjs.org/"

[silverwind]

Actually it seems it's really not a problem because npm and likely other package managers ignore the resolved property. It seems to serve no purpose and is likely a artifact from past npm versions that used it, but as per https://stackoverflow.com/questions/53814967 npm does not use it any more since v5.

Edit: Not sure if it holds correct but as per npm/npm#16849 (comment) it does use it for some form of cache that invalidates when the url does not match the current registry url, so still, harmless.