Document shrinkwrap best practices

[lkptrzk]

It's not too clear from the history of npm-shrinkwrap.json in hapijs/hapi what the guidelines are for maintaining it. Seems like it just snuck in unceremoniously via hapijs/hapi#2039.

I've noticed a few shrinkwrap-related issues filed in the hapi repo due to npm whatever --production, so it seems like a relevant thing to document.

Some notes I think would be cool to see:

• tl;dr of why it's used
• When it's okay to change it
• Warning of what kind of bugs it could cause
• Rationale for why it differs from the default npm shrinkwrap output

[hueniverse]

It's used because it is the only way I have to ensure the version you npm install has been fully verified by me. Otherwise, with so many maintainers and dependencies, you can never know if your integrated hapi experience is valid and secure.

You can change or ignore it if you know what you are doing (e.g. tested and verified the changes not included in it yourself).

The format is manually modified to allow easier maintenance.

[lkptrzk]

thanks