What exactly does package-lock.json lock: only dependencies from package.json or also transitive dependencies?