switch core/web-assets from yarn to npm

Now that npm supports locking similar to yarn, switch to using it instead to reduce the number of external tools that need downloading.  Also yarn 1.x has some general structural issues that npm handles better nowadays. Until yarn 2 comes out, we're probably better off with npm anyway.