shrinkwrap update from 314c8a1

Apparently not passing --force to npm install also allows us to do a
better job of not bundling duplicate npm packages.