remove package-lock.json from repo
I think we should remove `package-lock.json` from the repo and add it to `.gitignore`.

There's no need to keep lock files in the rpo, or am I missing something?

@xuv what's your take on this? Is there a reason why this file is in the repo?