return to pinning `dependencies` in `vcode-graphql`

[acao]

I'm noticing @divyenduz 's original vscode-graphql package.json had pinned dependencies and I think I understand why. ^ versions when you're shipping shared libraries work pretty great. But for end consuming clients that have to ship a fixed bundle? And can't benefit from patch updates? Pin the dependencies to reduce the unnecessary surprises 😬 😆 !

Originally posted by @acao in https://github.com/graphql/graphiql/issues/2658#issuecomment-1212466000