Add package-lock.json for dependency transparency

In light of recent ua-parser-js hijacking issue, add package-lock to image for easy examination of npm dependencies