Don't let Travis run npm update during setup

[Snuffleupagus]

Letting Travis update npm packages can lead to unexpected and completely unrelated failures for any PR and/or merge, see e.g. #11719, if there's ever backwards incompatible changes when a package is updated.

The exact package versions are specified in package-lock.json, and they should thus be used when running tests. Note that the bots won't update npm packages, and neither should Travis as far as I'm concerned.

[Snuffleupagus]

/botio unittest

[pdfjsbot]

From: Bot.io (Windows)

---

Received

Command cmd_unittest from @Snuffleupagus received. Current queue size: 0

Live output at: http://54.215.176.217:8877/aeb4518bf7b097f/output.txt

[pdfjsbot]

From: Bot.io (Linux m4)

---

Received

Command cmd_unittest from @Snuffleupagus received. Current queue size: 0

Live output at: http://54.67.70.0:8877/29cd1f7027bce0f/output.txt

[pdfjsbot]

From: Bot.io (Linux m4)

---

Success

Full output at http://54.67.70.0:8877/29cd1f7027bce0f/output.txt

Total script time: 2.70 mins

• Unit Tests: Passed

[pdfjsbot]

From: Bot.io (Windows)

---

Success

Full output at http://54.215.176.217:8877/aeb4518bf7b097f/output.txt

Total script time: 4.25 mins

• Unit Tests: Passed

[timvandermeij]

It looks like I added that four years ago and I must say I can't recall why, but it shouldn't be necessary to have. Thanks!

[Snuffleupagus]

It looks like I added that four years ago and I must say I can't recall why, but it shouldn't be necessary to have. Thanks!

The only thing I can possibly think of is that we didn't use a package-lock.json file until much later, meaning that the installed package versions were more arbitrary. Perhaps the idea was that it's better to be guaranteed to use the latest versions, rather than a more arbitrary state.