ci: use npm trusted publishers (OIDC) instead of NPM_TOKEN

Author: elitan

.github/workflows/publish.yml

@@ -42,9 +42,7 @@ jobs:
         registry-url: 'https://registry.npmjs.org'
 
     - name: Publish to npm
-      run: npm publish --provenance
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      run: npm publish --provenance --access public
 
     - name: Create GitHub Release
       uses: softprops/action-gh-release@v2