Recreate package-lock.json (#257)

This was done by deleting it and running `npm install`. This bumps the
lockfile version to 3 and bumps lots of transient dependencies, which
has the important side effect of resolving all `npm audit` issues.