Support for npm 5 package-lock.json

[mars]

npm 5 dramatically changes npm install behavior by using a deterministic lock file. Unfortunately, this causes the modules installed by npm install --only=dev to be erased before the build. So, create-react-app's build process stops working!

This changeset revises the order of installation to dependencies first, then devDependencies, and it forces npm to ignore the lock file (using the --no-shrinkwrap flag) for devDependencies.

It comes at the price of, when package-lock.json is present, removing & reinstalling all devDependencies on each deploy.

Another solution is to manually move react-scripts (& other devDeps required for build) to the productiondependencies in package.json.