Only use cache layer if yarn.lock AND package.json match

[c0d1ngm0nk3y]

Fixes #143

Summary

When checking the sha in the metadata if the cache layer can be reused, not only check yarn.lock but also package.json for changes. This also aligns the behaviour with npm-install where package.json and package.lock are used to calculate the sha.

Use Cases

If the user somehow changes the package.json without changing yarn.lock, this will now not use the cached layer, but install the packages again with the changed package.json.

Checklist

• I have viewed, signed, and submitted the Contributor License Agreement.
• I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• I have added an integration test, if necessary.
• I have reviewed the styleguide for guidance on my code quality.
• I'm happy with the commit history on this PR (I have rebased/squashed as needed).

[mhdawson]

LGTM