Which command should be used to install dependencies when package-lock.json is present and should this file be committed?