Missing package-lock.json

[mglaman]

The project specifies to use npm over yarn, there should be a package-lock.json to ensure repeatable installations across contributor setups.