Implement lockfile checks for backend

[achou11]

Introduced lockfile checks for version and dep changes at the app level via #892. Ideally we have something similar for the backend.

• for lockfile version, not sure if there's a straightforward way of getting it to work given the tooling we're using. may need to punt on this (not really as useful or important in all fairness)

• for deps changes, basically can do what Gregor explained in chore: add workflow for lockfile checks #892 (comment), but needs fix: include comment header when getting existing comment ID npm-lockfile-changes#2 to be merged first I think?