build(core): add --frozen-lockfile flag where missing (#3609)

* chore: add --frozen-lockfile flag in dockerfiles

This was previously omitted when we first refactored the Dockerfiles to
use pnpm but didn't have the top-level context and pnpm lock file as
yet.

* chore: add --frozen-lockfile flag in buck dev rules

core/api/Dockerfile-debug

@@ -12,7 +12,7 @@ COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
 
 WORKDIR /app/core/api
 
-RUN pnpm install
+RUN pnpm install --frozen-lockfile
 
 COPY ./core/api/src ./src
 COPY ./core/api/test ./test

core/api/Dockerfile-migrate

@@ -12,7 +12,7 @@ COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
 
 WORKDIR /app/core/api
 
-RUN pnpm install
+RUN pnpm install --frozen-lockfile
 
 COPY ./core/api/src ./src
 COPY ./core/api/test ./test

toolchains/workspace-pnpm/macros.bzl

@@ -1017,7 +1017,7 @@ npm_run_command="$3"
 
 cd "$rootpath/$npm_package_path"
 if [ "$install_node_modules" = "True" ]; then
-    pnpm install
+    pnpm install --frozen-lockfile
 fi
 if [ "${*:4}" ]; then
     exec pnpm run --report-summary "$npm_run_command" -- "${@:4}"
@@ -1049,7 +1049,7 @@ npm_run_command="$3"
 
 cd "$rootpath/$npm_package_path"
 if [ "$install_node_modules" = "True" ]; then
-    pnpm install
+    pnpm install --frozen-lockfile
 fi
 exec pnpm run --report-summary "$npm_run_command"
 """, is_executable = True)