feat: include package.json files in code bundle cache hash

[sorccu]

Summary

• Extends the Playwright code bundle CacheHash to cover every package.json outside node_modules/ (at any depth) in addition to the lockfile, so dependency changes declared only in a package.json correctly invalidate the cache.
• Canonicalizes each package.json (parse, strip top-level version, re-marshal with sorted keys) before hashing so cosmetic differences and CI-driven version bumps — e.g. auto-stamped commit-hash versions — don't churn the cache.
• Renames PlaywrightCodeBundleMetadata.LockfileChecksum → CacheHash (and JSON tag lcs → ch), and bumps the metadata version to 4 so existing resources recompute on first plan after upgrade.

Notes for reviewers

• InspectLockfile gained an InspectLockfileOptions{PackageJSONExcludedFields} parameter. The production caller passes []string{"version"}.
• Final checksum = SHA-256 of length-prefixed records: lockfile:<name> + lockfile hash, then each canonical package.json sorted by path.
• Metadata version bump to 4 means Terraform will replace (and re-upload) existing checkly_playwright_code_bundle resources on next plan after upgrade — this is intentional, to get everyone onto the new hash.

Test plan

• go test ./checkly -run TestInspectLockfile — all pre-existing + 6 new subtests pass.
• Acceptance tests to confirm no regression in the full bundle flow.
• Manual check: modify only version in a bundle's package.json, confirm no diff on terraform plan; modify another field (e.g. scripts), confirm a replacement is planned.

🤖 Generated with Claude Code