[Tracker] Stable installs

[jordy25519]

We depend on some @polkadot/* packages which we lock to specific versions for development purposes, all is fine.
However yarn.lock and package-lock.json are ignored in published packages, so user installs may break if a dependency of our dependencies doesn't respect semver.

This problem is common in many package ecosystems, normally the offending package should be yanked.
However @polkadot/* moves fast and breaks stuff so we can't rely on that here.

To provide stable installs, current known options are (in order of preference):

• Strongly suggest users useyarn + resolutions in their package.json
• Publish a shrinkwrap.json for npm (risks attached)
• Hope @polkadot respects semver after doing some upgrade work
• Vendor deps (pls no)