These checkboxes keep getting checked despite the submitter using an
insecure context or not having tested upstream. I think two things are
at play here:
1. Folks might be interpreting "cannot reproduce" as "did not
reproduce" or "did not have time to reproduce".
2. The checkboxes are required to submit the issue so folks might be
marking them just so they can get their issue submitted; maybe they
are not even reading the checkboxes and are just seeing the error
that they need to be marked and blindly marking them because while
in some cases folks will add "I had to check this but it is not
true", usually they say nothing.
In any case, hopefully these changes make the checkboxes more accurate,
and then if they are unchecked we can ask them to go reproduce in VS
Code or use a secure context or whatever the case may be.
We tried to switch from `yarn` to `npm` because `yarn` ignores lockfiles
but learned that we missed a few key things.
For now, we are reverting docs and a few other changes that suggested
using `npm` instead of `yarn` until we fully remove `yarn` from the
codebase.
t Please enter the commit message for your changes. Lines starting
