Setup steps make package-lock and package.json out of sync with master

[peterflynn]

I think there are two separate issues here:

1) If I'm on clean-slate master and I run npm install, a bunch of local changes appear in package.lock.json -- this probably means someone previously updated package.json and forgot to commit the corresponding package-lock.json changes, leaving the two files out of sync with one another in master. It also means we're not on well-defined/consistent versions of some of our dependencies.

The package at issue seems to be gitbook-plugin-bulk-redirect, but I'm also seeing several no-op diffs where other packages (JSONStream, string_decoder) are getting moved to a different place in the order without any actual changes.

2) If I then run npm run book:install, a local change also appears in package.json. I'm not sure if this means someone previously updated book.json and forgot to commit the package.json changes that it resulted in, or if it means gitbook install somehow fails to use npm in a way that obeys our package-lock rules to enforce consistency...?

In this case the diff is:
"gitbook-plugin-anchorjs": "^2.0.1" --> "gitbook-plugin-anchorjs": "^2.1.0"

Expected behavior:
Running the setup steps npm install and npm run book:install should not cause git status to show any local diffs.