Remove `lockdown`, use `npm shrinkwrap`

For documentation on `npm shrinkwrap` see
https://npmjs.org/doc/shrinkwrap.html.

The reason wanting to make that change is that I `npm shrinkwrap` is more the de facto standard for locking down `npm` dependencies (I wanted to start working on upgrading `express` but ran into `lockdown` error).

I read in #2022 that you use different sets of dependencies in production and development, and that's still easy with shrinkwrap: `vim package.json; rm npm-shrinkwrap.json; npm i; npm shrinkwrap`.