Add npm@5 package-lock.json artifact

[crccheck]

Why are we doing this?

This adds Npm v5's package-lock.json. It also updates some dependencies. Eventually, someone else will be running Npm v5 and will generate this file too, so I'm committing it now for the future.

Did you document your work?

N/A

How can someone test these changes?

Steps to manually verify the change:

1. npm i
2. npm t

What possible risks or adverse effects are there?

• As usually, some dep update may break something, but no major prod dep versions were upgraded.
• The package-lock.json throws off github line diff counts, so they no longer mean anything.

What are the follow-up tasks?

none

Are there any known issues?

none

Did the test coverage decrease?

none, keeps the project up to date.

[crccheck]

They changed the indention rules in Eslint v4 http://eslint.org/docs/user-guide/migrating-to-4.0.0

I don't really like them, but if that's what JavaScript is doing 🤷‍♂️ I'll live with it

[stripethree]

Would it be useful to add a link or some documentation in the summary for future developers on how package-lock.json gets updated?

[crccheck]

When you use npm, it says:

npm notice created a lockfile as package-lock.json. You should commit this file.

I think that's enough documentation.