Use NPM shrinkwrap instead of package-lock.json

In theory and or in practice, the problems that we have with package-lock.json, that it is updated everytime we run npm install, should be fixed by using a file called npm-shrinkwrap.json instead of package-lock.json, which is a file with exactly the same contents as package-lock.json, but instead this file should not be overwritten on each update.

Should be tested before we can merge.