npm_install doesn't use lockfile about rules_nodejs

[gregmagolan]

#106 adds yarn_install which can accept a yarn.lock file.

[alexeagle]

@gregmagolan does that mean if you keep using npm, you'll have floating deps? Meaning we won't fix this?

[gregmagolan]

@gregmagolan does that mean if you keep using npm, you'll have floating deps? Meaning we won't fix this?

I added the ability a package_lock_json attribute to the npm_install rule in #106. This should make it deterministic but I'm not too familiar with npm locks files or the non-hermetic behavior observed with npm.

[alexeagle]

okay cool, we should fix the determinism too but that's not this issue.

We should update our rules that use npm_install to include package-lock.json...

[gregmagolan]

package_lock_json attribute added in #106 which resolves this