Improve distribution security for Theia NPM packages

[kkistm]

Supply chain security was always a very important question. There is a proposition to improve Theia distribution security with a some steps:

• Provide provenance information together with packages (see https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/)
• Earn OpenSSF Best Practices Badge (more details here https://github.com/coreinfrastructure/best-practices-badge?tab=readme-ov-file#openssf-best-practices-badge-formerly-cii-best-practices-badge)

[tsmaeder]

That seems like a good idea, but I fear we'll have to do some cleanup of our publishing workflow before we can publish automatically from github.