Use the NPM dependencies from the gha/v0 branch (#504)

The staging and production website builds now download `package.json`
and `package-lock.json` from the `gha/v0` branch of `logging-parent`,
so all Apache Logging websites share the same Antora dependency tree.
Dependabot keeps those dependencies up to date there,
which makes the local npm entry and the committed lock file redundant.

Release website staging still uses the committed `package.json`,
which now only points at the shared dependency set.

Assisted-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: ppkarwasz

.github/dependabot.yaml

@@ -66,12 +66,3 @@ updates:
       github-actions-updates:
         patterns: [ "*" ]
     target-branch: "trunk"
-
-  - package-ecosystem: npm
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    groups:
-      npm-updates:
-        patterns: [ "*" ]
-    target-branch: "trunk"

.github/workflows/deploy-site.yaml

@@ -46,6 +46,7 @@ jobs:
           whoami: ${{ github.ref_name }}-site-stg-out
           subdir: content/flume/2.x
       install-required: true
+      npm-dependencies-ref: gha/v0
       target-branch: ${{ github.ref_name }}-site-stg-out
 
   deploy-site-pro:
@@ -61,6 +62,7 @@ jobs:
           whoami: ${{ github.ref_name }}-out
           subdir: content/flume/2.x
       install-required: true
+      npm-dependencies-ref: gha/v0
       target-branch: ${{ github.ref_name }}-out
 
   export-version:
@@ -88,4 +90,5 @@ jobs:
           whoami: ${{ github.ref_name }}-site-stg-out
           subdir: content/flume/${{ needs.export-version.outputs.version }}
       install-required: true
+      # `npm-dependencies-ref` is omitted: the `package.json` committed in the repository is used
       target-branch: ${{ github.ref_name }}-site-stg-out