package lock json gitignore or not