Explicitly list file sin package.json

To avoid publishing whatever happens to be in the working copy.

Equivalent of https://github.com/vector-im/vector-web/pull/2516
for react-sdk.

package.json

@@ -9,6 +9,23 @@
   },
   "license": "Apache-2.0",
   "main": "lib/index.js",
+  "files": [
+    "CHANGELOG.md",
+    "CONTRIBUTING.rst",
+    "LICENSE",
+    "README.md",
+    "code_style.md",
+    "git-revision.txt",
+    "header",
+    "jenkins.sh",
+    "karma.conf.js",
+    "lib",
+    "package.json",
+    "release.sh",
+    "scripts",
+    "src",
+    "test"
+  ],
   "bin": {
     "reskindex": "scripts/reskindex.js"
   },