chore: restore semantic-release in package-lock.json

SHA1-Hulud makes me definitely not want to be responsible
for failing to pin versions of semantic-release, etc. Updating
package-lock.json has extra annoying steps, but is still possible.
Like I did here.

Author: Trott