fix: explicitly set our preferred package manager for js dependencies

[G-Rath]

react-rails now supports other package managers using package_json, meaning it now defaults to npm if a package manager is not explicitly set in package.json, causing a stray package-lock.json to be created.

I've specified an exact version because currently corepack requires that (ranges are not yet supported) but we're not actually expecting anyone to be using corepack and we're definitely not using it in production (not explicitly at least...) so in theory this shouldn't cause problems and it means package.json conforms to the JSON schema - it'll also help to flush out any potential problems early before(/if) corepack becomes more mainstream.

[joshmcarthur]

Approved, with the standard observation that it would be nice to be able to put comments into package.json to explain why we do things like an exact version lock