add package-lock.json ...

github automation failed because it wasn't present