docs: package-lock.json is never allowed in tarballs (#16799)

Ref: https://github.com/npm/npm/blob/v5.0.0/lib/utils/tar.js#L106-L107
PR-URL: npm/npm#16799
Credit: @sonicdoe
Reviewed-By: @zkat

Author: sonicdoe

doc/files/package.json.md

@@ -204,6 +204,7 @@ Conversely, some files are always ignored:
 * `node_modules`
 * `config.gypi`
 * `*.orig`
+* `package-lock.json` (use shrinkwrap instead)
 
 ## main