package maintenance

[zypA13510]

some improvements:

• include a lockfile, many best practice guides recommend committing this file, including npm and yarn themselves
• pin devDependencies (mocha & should) to their latest major version, again, seems like a good practice
• bump version to 1.0.0 (stable), this will improve the maintenance score on npm.