Check in package-lock.json

Previously package-lock.json was gitignored. At one point the recommended
practice was for libraries to not commit it, because committing it would
prevent CI from detecting incompatible new versions of dependencies. That
may have been good advice before it became common for attackers to publish
malicious versions of legitimate packages via compromised maintainer
accounts. Checking in a lockfile protects Jasmine developers against that
threat by preventing new versions from being accidentaly installed.

Author: sgravrock

.gitignore

@@ -4,5 +4,4 @@ node_modules/
 tags
 sauce_connect.log
 yarn.lock
-package-lock.json
 .envrc