update lockfile + depend explicitly on eslint-plugin-react

eslint-plugin-react is used by eslint-config-standard-preact, and is a
dependency of it. when eslint is run, it tries to
require('eslint-plugin-react') from the root of the project, which isn't
guaranteed to work (although npm hoisting will _normally_ let it work).
if we depend on it explicitly this will always work.

package.json

@@ -40,6 +40,7 @@
     "eslint-plugin-jest": "^21.27.2",
     "eslint-plugin-node": "^4.2.3",
     "eslint-plugin-promise": "^3.8.0",
+    "eslint-plugin-react": "^7.12.4",
     "eslint-plugin-standard": "^3.1.0",
     "exorcist": "^1.0.1",
     "fakefile": "0.0.9",