should we gitignore package-lock.json