Either decide between Yarn/NPM or at least make sure to keep them in sync

[kraftner]

Currently we have a yarn.lock and a package-lock.json in the repo. I think we should decide which one to use because having two lock files for the same thing is confusing.

The other approach (although I think that is hard to do consistently) is having both but always keeping them in sync.

[atimmer]

We are using yarn on all our repositories. For consistency for us I think we would prefer yarn.

[moorscode]

We want to use one, and we want yarn.