Add package-lock.json

Committing the package lock is recommended for versioning consistency
and will also allow tooling like dependabot to automate fixes.

Author: dibenede