Set up package.json for the npm dependencies

Complicating factor: this has to work for both the github workflow and the local scripts. They have the same dependencies but work on different OSes and npm versions.

Also desirable to pin the versions to prevent accidental app/workflow breakage.
