Switch to OIDC trusted publisher for npm publishing

Replace NPM_TOKEN secret with GitHub Actions OIDC id-token for
authentication. Add --provenance flag for SLSA attestation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: asklar

.github/workflows/publish.yml

@@ -8,6 +8,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -25,6 +28,4 @@ jobs:
         run: npm run build
 
       - name: Publish
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --access public