Ensure Node.js >= 10 support

[legobeat]

• Breaking: Increase minimum Node.js version to 10
  • Remove compatibility patch fix(node 0.12 compat): Fall back to old Buffer constructor when Buffer.alloc not available #29
  • Test: Update expected source-maps to be Node.js v10+ compatible
• Check in package-lock.json
  • ci: Enable npm cache of node modules

Related

• This is broken out from and mostly similar to fix: Buffer warning & update ci #24 except:
  • Maintain compatibility with node v10 (in interest of debian-buster and ubuntu 20.04 lts distro users)
  • package-lock.json instead of yarn.lock
  • Unrelated changes omitted

Depends on

• Release 0.6.4 #32
• Release v0.6.4 #34
  • sync released v0.6.3 #33
    • ci: Migrate from Travis CI to GitHub Actions #27
    • devDeps: non-breaking bumps of tap, nave #26
    • fix: refactor deprecated Buffer usage #25

[legobeat]

@thlorenz Given that this is a breaking change and there is an unreleased change in the pipe, I'm keeping this and #31 in draft pending release (#32).

[thlorenz]

Hey looks good, but please don't check in a package.lock for the following reasons:

1. don't want to limit peeps to use npm when installing and get different results when using yarn
2. package lock makes sense for apps not libraries as in a lib we actually do want to get patch updates of the libs we depend on

People can then lock everything on their app level.

[legobeat]

don't want to limit peeps to use npm when installing and get different results when using yarn

It actually doesn't under most scenarios for users - lockfiles are disregarded when installing from registry/bundle/git and basically only/mostly used for dev/local build/ci. And when using a differing package manager like yarn/pnpm, IME it's usually a warning, not an error, to have package-lock.json present?

I think there is a lot of value in reproducibility and auditability in checking in the lockfile.

But in any case: Lifting it out of scope from this PR. So this PR doesn't include the lockfile addition/ci cache anymore. Also just rebased on master.