ci: use locked dependencies and fail on high audit findings

.github/workflows/qa.yml

@@ -13,7 +13,8 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm install
+      - run: npm ci
+      - run: npm audit --audit-level=high
       - run: npm run check:deploy
       - run: npx playwright install --with-deps chromium
       - run: npm run test:e2e