Consider locking Node and NPM version

[designorant]

Node and NPM should ideally be specified in engines property in package.json, and maybe locked via .nvmrc/.node-version files too.

Even with Node v12 as per current DP prerequisites it's clear that different NPM versions were used to resolve packages and create package-lock.json files.

Running make build with [email protected] and [email protected] (that it comes with by default) results with:

npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but package-lock.json was generated for lockfileVersion@2. I'll try to do my best with it!

which then results in different package-lock.json files:

	modified:   src/legacy/package-lock.json
	modified:   src/package-lock.json

Oddly enough src/package-lock.json is in .gitignore file and yet it's there in the repo. 🤷‍♂️

[designorant]

Related: #781

[designorant]

The issue above don't seem to be the case anymore but the lock/requirement should really be in place to avoid similar problems in the future.