git should i commit package lock json