Add lockfiles (#34)

We're scanning more of our package repo code with Snyk now, and it requires lockfiles to accurately know which versions of packages are being used.

Author: jasononeil