Use npm shrinkwrap to make sure dependencies of dependencies are also 'fixed'

Recently had a problem where we specified a certain version of a npm dependency: grunt-sass. had a version range specified on one of its depenencies, node-sass, and that dependency updated with a change that broke our build.

We specify a certain version (not a range) to make sure we actually have that same version in a release. However we do not 'protect' ourselves against the dependencies of our dependencies. We can use npm shrinkwrap for this. We should probably use npm shrinkwrap before tagging to ensure we have a working tag.