Use package-lock.json

[bbondy]

Fix #8283

Auditors: @diracdeltas

Submitter Checklist:

• Submitted a ticket for my issue if one did not already exist.
• Used Github auto-closing keywords in the commit message.
• Added/updated tests for this change (for new code or code which already has tests).
• Ran git rebase -i to squash commits (if needed).
• Tagged reviewers and labelled the pull request as needed.

Test Plan:

Reviewer Checklist:

Tests

• Adequate test coverage exists to prevent regressions
• Tests should be independent and work correctly when run individually or as a suite ref
• New files have MPL2 license header

[bbondy]

Marking as work in progress until I verify travis is ok with this.

[diracdeltas]

it looks like Travis has yet to add support for caching dependencies using package-lock travis-ci/travis-ci#7936