package.json: Point git-url to Git repository instead of Gerrit project page

Change-Id: I014a9bd91cb33d30e877fbf7715b20b7975aa16b
package.json: Pin dependencies at a fixed version

Upgrade explicitly to avoid silently upgrading to newer versions.
When an in compatibility is found and using 'latest' (or '*') it'll
be hard to track which version worked using e.g. git-bisect as
it'd get the latest still.

It also ensures that the dependencies are the same for different
developers with and without npm-cache locally.

Using a service like https://david-dm.org/wikimedia/citoid one
can quickly check if there are newer versions available.

Change-Id: I98cced5d5eeedbb7554103f449bbc2afa073327c