Pin npm versions via config

[mbostock]

Like we manually do for @duckdb/duckdb-wasm, it’d be nice if you could control the default version for packages, and perhaps the default entry. (But perhaps this is unnecessary since you can use a package manager #360 if you want to control versions.)

[mbostock]

This is getting into deno.lock territory, too.