chore(docs): remove package-lock.json

We're using `yarn`, so it's redundant (and potentially misleading).

This will hopefully get rid of false-positives in our GitHub security
alerts.