Add flatpak/fix-lockfile.mjs (vendored from npm-package-lock-add-resolved,
MIT) to add missing resolved/integrity fields to package-lock.json.
Use it in generate-sources.sh, and use a simpler inline Node one-liner in
the manifest for the offline build-time patch.
