WIP: added yarn audit to tests and CI.

@nicksellen what do you think about such an approach?

We'd need to whitelist jquery or finally fix that first.