ci: drop NODE_AUTH_TOKEN from npm publish workflow

The previous publish run 404'd because `NPM_TOKEN` no longer has
publish permission for `react-native-square-in-app-payments`. Switch
the workflow to rely on npm trusted publishing (OIDC) via the
`id-token: write` permission already granted to the job, and bump the
runner's npm CLI to latest so it supports the current trusted-publisher
flow.

Author: Armaxis

.github/workflows/npm-publish-github-packages.yml

@@ -34,8 +34,7 @@ jobs:
       - name: Build package tarball with Yarn
         run: yarn pack --out package.tgz
 
+      - run: npm install -g npm@latest
       # Still use npm to publish the already-generated tarball
       - name: Publish to npm
-        run: npm publish package.tgz --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish package.tgz --provenance --access public