[PR #8140/d2ea8118 backport][3.9] Use NPM clean install and upgrade node to v18

[patchback]

This is a backport of PR #8140 as merged into master (d2ea811).

What do these changes do?

• Installs llhttp using npm ci for security and to preserve the lock file. This command should always be used in CI.
• Upgrades Node.js from v14 (out of maintenance) to v18 (current LTS maintenance release and also what the llhttp Dockerfile is using)

Are there changes in behavior for the user?

No

Is it a substantial burden for the maintainers to support this?

No

Related issue number

Fixes #8116

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes
• If you provide code modification, please add yourself to CONTRIBUTORS.txt
  • The format is <Name> <Surname>.
  • Please keep alphabetical order, the file is sorted by names.
• Add a new news fragment into the CHANGES/ folder

  • name it <issue_or_pr_num>.<type>.rst (e.g. 588.bugfix.rst)

  • if you don't have an issue number, change it to the pull request
    number after creating the PR

    • .bugfix: A bug fix for something the maintainers deemed an
      improper undesired behavior that got corrected to match
      pre-agreed expectations.
    • .feature: A new behavior, public APIs. That sort of stuff.
    • .deprecation: A declaration of future API removals and breaking
      changes in behavior.
    • .breaking: When something public is removed in a breaking way.
      Could be deprecated in an earlier release.
    • .doc: Notable updates to the documentation structure or build
      process.
    • .packaging: Notes for downstreams about unobvious side effects
      and tooling. Changes in the test invocation considerations and
      runtime assumptions.
    • .contrib: Stuff that affects the contributor experience. e.g.
      Running tests, building the docs, setting up the development
      environment.
    • .misc: Changes that are hard to assign to any of the above
      categories.

  • Make sure to use full sentences with correct case and punctuation,
    for example:

    Fixed issue with non-ascii contents in doctest text files
    -- by :user:`contributor-gh-handle`.

    Use the past tense or the present tense a non-imperative mood,
    referring to what's changed compared to the last released version
    of this project.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (a7a72ae) 96.22% compared to head (6290d08) 97.30%.
Report is 1 commits behind head on 3.9.

Additional details and impacted files

@@            Coverage Diff             @@
##              3.9    #8149      +/-   ##
==========================================
+ Coverage   96.22%   97.30%   +1.08%     
==========================================
  Files         108      108              
  Lines       32597    32625      +28     
  Branches     2080     3872    +1792     
==========================================
+ Hits        31366    31747     +381     
+ Misses        974      671     -303     
+ Partials      257      207      -50     

Flag	Coverage Δ
CI-GHA	97.21% <ø> (+0.99%)	⬆️
OS-Linux	96.91% <ø> (+0.68%)	⬆️
OS-Windows	94.41% <ø> (?)
OS-macOS	96.72% <ø> (?)
Py-3.10.11	94.31% <ø> (?)
Py-3.10.13	96.69% <ø> (?)
Py-3.11.7	96.45% <ø> (?)
Py-3.12.1	96.50% <ø> (?)
Py-3.8.10	94.29% <ø> (?)
Py-3.8.18	96.62% <ø> (?)
Py-3.9.13	94.30% <ø> (?)
Py-3.9.18	96.67% <ø> (?)
Py-pypy7.3.15	96.22% <ø> (-0.01%)	⬇️
VM-macos	96.72% <ø> (?)
VM-ubuntu	96.91% <ø> (+0.68%)	⬆️
VM-windows	94.41% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.