Update grunt-contrib-qunit to 3.1.0 and add package-lock.json

This resolves lodash vulnerabilities.

package.json

@@ -28,7 +28,7 @@
     "eslint-config-wikimedia": "^0.7.2",
     "eslint-plugin-qunit": "^3.3.0",
     "grunt": "1.0.4",
-    "grunt-contrib-qunit": "^3.0.1",
+    "grunt-contrib-qunit": "3.1.0",
     "grunt-eslint": "21.0.0",
     "grunt-stylelint": "0.11.0",
     "stylelint": "10.1.0",