remove requirement for package lock file

[jkowalleck]

caused by #232

Is your feature request related to a problem? Please describe.

current implementation tells users to have a package lock file.
internally it is not really needed. instead, npm ls is utilized.

and sometimes it is just not there - see https://docs.npmjs.com/cli/v9/using-npm/config#package-lock

Describe the solution you'd like

remove the demand for a package lock file.

Additional context

see npm config for the topic: https://docs.npmjs.com/cli/v9/using-npm/config#package-lock

[jkowalleck]

originally the pinning on the lockfile was enforced for forward-compatibility,
in case in the future the lockfile needed to be read manually.

this is no longer planned, nor foreseen. therefore, the lock-file requirement can be dropped.