feat: add npm package provenance

[olizilla]

a verifiable way to link a package back to its source repository and the specific build instructions used to publish it.

• publish to npm with provenance flag
• update checkout and setup-node actions to v4

see: https://github.blog/2023-04-19-introducing-npm-package-provenance/

License: MIT