Bug 956884 - Add shrinkwrap to lock down dependencies' dependency versions r=kgrandon