Add npm-shrinkwrap.json to control dependency updates

[pdcastro]

Resolves: #1293
Change-type: patch

[thgreasi]

I think that 2.3 broke the typings but for sure we now don't have any reason to not change it to a ^.
After all, whoever tries to change the shrinkwrap will see whether it breaks the build.

[pdcastro]

I didn't know about the typings, but I knew about 2 issues that I raised myself in the upstream repo:

• ReferenceError: window is not defined in v2.3.0
• ReferenceError: window is not defined in v2.3.1

... which had broken balena CLI and required us to pin it to ~2.2.2. Upstream claims to have fixed it but I have not tested it myself. I was careful to add npm-shrinkwrap.json in a separate previous commit to the unpinning, so the CLI should still use moment-duration-format v2.2.2 anyway.

[pdcastro]

@balena-ci retest

[pdcastro]

I've found that package-lock=false also disables npm-shrinkwrap.json, hence deleting this line and the resulting blank file.

[thgreasi]

It seems that we will have to cut a release for https://github.com/balena-io-modules/node-web-streams as @balena/node-web-streams and update the respective line in balena request (we did something like this before for grid-styled).
See: https://github.com/balena-io-modules/balena-request/blob/4f33d99336a0c697d25980aa3132cd2de18bbc65/package.json#L59

[pdcastro]

It seems that we will have to cut a release for https://github.com/balena-io-modules/node-web-streams as @balena/node-web-streams

@thgreasi, although I couldn't reproduce the issue on Friday as in the Flowdock discussion, I think there was indeed a problem that even affected users: see issues #1331 and #1332. Please review pull request #1334 that hopefully fixes the issue.