Remove package-lock.json in favour of yarn.lock (#2746)

In #2705, `package-lock.json` slipped in as part of the upgrade and
wasn't noticed, then we ended up with two lock files.

So far, it seems they've kept updated, but Heroku won't let us use the
correct buildpack configuration without removing one of them.