Change package.json to pegged npm versions, and ship a package-lock.json

[JimKerslake]

So that installation instructions in future tell end users to run npm ci not npm install (reduces security risks)