Renovate will now "maintain" npm@5's `package-lock.json` files on the same schedule as existing `yarn.lock` maintenance.

Closes #470