Lock files

Currently a Fastboot-enabled ember app generates a `dist/package.json` file programmatically on `ember build`.

This mostly works well, but it means that an `npm install` in this `dist/` directory is not deterministic and the production SSR server can have different dependencies without any code changes. This can cause difficult-to-reproduce bugs.

It would be useful to find a way for the production Fastboot server to use a lockfile instead.