fix: blank out ancient file from dependabot dependency graph

Dependencies from long deleted packages/angular-workspace/package-lock.json
still show up in the dependabot dependency graph:
https://github.com/ReadAlongs/Studio-Web/network/dependencies

Work-around applied: create an empty package-lock.json to replace it,
and delete it later.
Ref: dependabot/dependabot-core#2041 (comment)

Problem observed when we got a CVE notice for package `ip`, which we not
using, either directly or indirectly.