Add an autofixing rule for package-lock origin

[daedalus28]

We sometimes have package-lock churn swapping packages back and forth from https. Let's write an autofixer to always set it to https so we never have to deal with it again.

[daedalus28]

See npm/npm#20719