Run Yarn with `--frozen-lockfile` when `yarn.lock` is present

#1

Since npm already runs npm ci instead of npm install when package-lock.json is present, I’d expect Yarn to behave the same.

Instead, we seem to run yarn (shorthand for yarn install) and don’t fail on unsynced lockfile as I’d expect CI to do.

Build system information
Build language: node_js
Build group: stable
Build dist: trusty

$ yarn --version
1.3.2