lock it all down!

We have most of our dependencies set, we should lock it down now. We need this before we can get to stage.

This includes the lockdown.js script in the repo, since we don't want to trust npm to give us a modified lockdown module. I **hate** this. I'd rather change our lockdown dependency to point at our own repo on gitmirror.mozilla.org, so as not to have rotting scripts.

Also, since I live on Windows, jwcrypto doesn't install bigint. Lockdown was kind to tell me that it noticed a dependency on bigint that isn't in the lockdown.json. So `lockdown-relock` needs to be run on a *nix-y machine.

fixes #7