Adding package-lock.json back to source control

It should have always been committed, IMO. It is the only way to ensure
reproducible builds. This has already caused problems; the upgrade to
Shudan 1.7.0 was backwards-incompatible and so v0.52.0 wouldn't build
anymore without an edit to package.json to pin to Shudan 1.6.4 which was
current when v0.52.0 was released.

With this change we will be able to exactly reproduce the dependency
closure used for a particular tag.

.gitignore

@@ -6,7 +6,6 @@ node_modules/
 bundle.js
 bundle.js.LICENSE.txt
 bundle.js.map
-package-lock.json
 
 *.pdn
 *.vbs