devops: use --provenance when publishing to NPM (#83)

Similar to how we do it upstream:
e2c8163b14/utils/publish_all_packages.sh (L97)

Reference: https://docs.npmjs.com/generating-provenance-statements

.github/workflows/publish.yml

@@ -15,6 +15,6 @@ jobs:
       - run: npm run build
       - run: npm run lint
       - run: npm run test
-      - run: npm publish
+      - run: npm publish --provenance
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}