commit package-lock.json

without this, software was not reproducible.

Note that this was generated today, with current resolutions.