Add package-lock.json

It can be force-created (even when ~/.npmrc contains package-lock=false) as follows:

    npm install --package-lock

Closes #52.

Author: mathiasbynens