use npm ci instead of npm install

because this is quicker, but also validates that the package-lock is in sync with the package.json

Without this anything in the package.json that is out of sync with the package-lock gets silently updated and the integrity is not checked

scripts/travis.sh

@@ -3,7 +3,7 @@
 set -ev
 
 echo "travis_fold:start:npm_install"
-npm install
+npm ci
 echo "travis_fold:end:npm_install"
 
 if [ "${TRAVIS_MODE}" = "build" ]; then