Build plugins with --from-lock-file flag

[cmbirk]

Every time plugins are build as submodules to the core repo npm updates the package-lock.json file with updated versions. This has a couple drawbacks:

• The package versions installed aren't entirely consistent
• The subrepos show as modified dirty subrepos because of the changed file. This makes it difficult to modify plugins in context of the core repo because git status will show all subrepos as having changed content.

When initializing the subrepos we should include the --from-lock-file flag to keep this from happening

[brent-hoover]

This should be something we do sooner rather than later. Trying to manage a repo with custom plugins with submodule (which is our recommended way) is really difficult and error-prone currently.