Summary

Since we do not use Yarn 2 (there is a solution for this in v2), the purpose of this ticket is to come up with a safe way (so not deleting the yarn.lock file and create it from scratch with production flags) to have a yarn.lock file with just dependencies so we avoid false positives when analysing the Docker image.

Another solution of course would be using Yarn 2, but it might be a bit of overkill.

After this is done we should get rid of this part of the GHA when publishing in Docker Hub.