chore: remove package-lock.json (#1237)

I just noticed that we have both a package-lock.json and a yarn.lock on
this branch.

- yarn.lock was added in 176cfd4 (Jan 2017) and only updated once, in
  c59af29 (also in Jan 2017).
- package-lock.json was added in e636edf (Oct 2017) and updated on a
  number of occasions, the latest being in 2cb99ed (April 2019).

Let's standardize on Yarn, to match what we're doing in the "master"
branch and in other projects.