Proposal: remove package locks

[Matteo Figus]

I am not a fan of having package locks in modules, I rather think they should be handled in the "end" app to lock the various subdeps. In that way, there are more opportunities to optimise (deduping) + keeping all the deps to the latest version (which is something now dependencies.io does for free).

Any objections on gitignoring it?

[Nick Balestra-Foster]

Agree couple of extra points in favor to this:

• at the moment this repo its been orchestrated with lerna without relying on its --hoist option or on similar alternatives like yarn workspaces, a package.lock will simply lock devDeps in the root, so not that useful.
• furthermore tokens are pretty much dependency-free, so not much point at all neither into locking them

Lastly, I'll also suggest that along gitIgnoring it, we also config lerna accordingly

[Lin Xu]

I agree with these points. We should .gitignore and then update lerna. Here is a PR to do that: #138