benchmark npm install methods

benchmark:
```bash
tasks/update/dependencies.mjs
rm package-lock.json node_modules
npm install
```
vs
```
tasks/update/dependencies.mjs
npm install 
npm update
```

compare resulting package-lock.json, the second might not actually be up to date,
which would make this approach insufficient.