add npm update step to release process

[jeffpaul]

This follows from the plugin-specific change in 10up/insert-special-characters#155 and applies it to our org-wide default CONTRIBUTING.md file for use in all projects.

[jeffpaul]

@dkotter assuming you're good with this here, I'll open PRs across the other repos to add this step in the release process (and then just merge each of those in without additional review) so please comment here to note whether you're ok with this applying across repos or if you'd like specific reviews in those repos as well.

[dkotter]

I mentioned this in the 10up/insert-special-characters#155 but my only concern here is sometimes running an npm update can bring in updates that have breaking changes (we've seen this a few times with composer update but I would assume a similar thing could happen with npm).

I'm okay with having this as part of our release process but may also be worth adding a step (or adding on to this new step) some instructions around testing, especially anything that uses those dependencies (building assets for instance).

[jeffpaul]

Let's sort out how to handle within the ISC PR and I'll update here for a broad 10up approach afterwards.

[dkotter]

I'm okay with this change, though I'm not seeing an actual test step in our instructions right now. I know some of our plugins have that and some don't, I'd recommend we add that to our standard process here which will hopefully catch any issues that may crop up from running an npm update

[jeffpaul]

Merged in trunk changes that had the newly-added test step, back to you @dkotter for review.

[dkotter]

So minor thing but we don't actually need to manually change the version number in package-lock.json if we are going to run an npm update in the next step, as that will bump that version for us

[jeffpaul]

I'm thinking that perhaps we remove the npm update step as there could be a LOT of changes coming in there that require a bit more testing than would likely happen in the Test step later on and worst case scenario could introduce something that holds up the release. I do, though, like the idea of trying to ensure we bump dependencies on some sort of regular basis but haven't figured out a better, reliable way to do that (though perhaps a GH Action that fires ~monthly/quarterly and opens a PR with the results of running npm update?).