we need to track package-lock.json to keep the tauri JS packages in sync with tauri's rust packages in cargo.lock