ci: publish npm package with provenance statement

[dsanders11]

Experiment to see if this works. I believe we meet all the prerequisites listed in https://docs.npmjs.com/generating-provenance-statements now that we publish from GHA.