ci: generate provenance statements when release

[kecrily]

Using npm publish --provenance, you can show the provenance in npmjs, making the whole process more transparent and easier to audit.

You can see the provenance at semver on npmjs

Ref Generating provenance statements | npm Docs

[kecrily]

I will extend it to all packages under eslint