ci: add --provenance flag for Trusted Publishers OIDC auth

Author: himorishige

.github/workflows/publish.yml

@@ -25,7 +25,10 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - run: pnpm install --frozen-lockfile
       - run: pnpm run build
       - run: pnpm test
-      - run: npm publish
+      - run: npm publish --provenance --access public