Add `package-lock.json` or `yarn.lock`

[AndersDJohnson]

We should lock down dependencies. Not sure if you prefer yarn or npm >=5.

[kentcdodds]

I prefer npm >= 5, but I don't like lock files in my open source projects. I explicitly ignore them because I find they cause more harm than good in my open source projects.

Thanks though!