Use NPM workspace commands instead of cding into package directory

[rmorshea]

Current Situation

The last release of the JS package event-to-object failed because the noxfile.py attempts to publish the package by cding into the package directory and running npm install. I'm not really sure why this is a problem but it seems to do with the fact the there's only a lockfile at the project root rather than for each package (maybe related issue).

Proposed Actions

We should instead run commands for each JS package via npm --workspace <the-package> <the-command>.