introduce package-lock.json; closes #3025 (#3026)

- update `.travis.yml` to use npm@5 caching where available
- remove `.npmrc` (now unused)
- remove `package-lock.json` from `.gitignore`

Author: boneskull

.gitignore

@@ -13,7 +13,6 @@ npm-debug.log*
 .nyc_output/
 coverage/
 yarn.lock
-package-lock.json
 mocha.js
 # artifacts from various diff tools
 *_BACKUP_*

.npmrc

@@ -52,3 +52,6 @@ addons:
       - .karma/
       - ./mocha.js
   sauce_connect: true
+cache:
+  directories:
+    - ~/.npm