CQS - lock down NPM dependencies

Closes CNVS-15990

Change-Id: I8a67acc5247b005fdd1841b5de607c8beff68762
Reviewed-on: https://gerrit.instructure.com/42154
Reviewed-by: Ryan Florence <ryanf@instructure.com>
Product-Review: Ryan Florence <ryanf@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
Tested-by: Ryan Florence <ryanf@instructure.com>