ci: add id-token write permission for npm provenance

Author: kevinmichaelchen

.github/workflows/CI.yml

@@ -146,6 +146,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'pull_request'
     needs:
       - build