NPM shinkwrap for reviewer

For v2.1.0, reviewer wrote in the email:

> Approving since the xpis could be sufficiently compared, but I've had some major differences between the generated and uploaded xpi. I suspect this is due to differing dependent packages, please consider including an npm-shrinkwrap file next time.
