Publish NPM package with provenance

[aklinker1]

WXT doesn't have provenance right now, so I'll do this in a separate PR.

Originally posted by @aklinker1 in #1649 (comment)