ci: use trusted publishing to publish our package

[crazy-max]

relates to https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/

https://github.com/docker/actions-toolkit/actions/runs/20333326955/job/58415637490#step:3:732

#12 45.12 npm notice unpacked size: 695.4 kB
#12 45.12 npm notice shasum: 86bf5c9e1ece9664de350294423ed865f233d17c
#12 45.12 npm notice integrity: sha512-o1CDEMipEF6wY[...]x7pfBlvGXYW5g==
#12 45.12 npm notice total files: 201
#12 45.12 npm notice
#12 45.12 npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
#12 45.71 npm notice Access token expired or revoked. Please try logging in again.
#12 45.72 npm error code E404
#12 45.72 npm error 404 Not Found - PUT https://registry.npmjs.org/@docker%2factions-toolkit - Not found
#12 45.72 npm error 404
#12 45.72 npm error 404  '@docker/actions-toolkit@0.70.0' is not in this registry.
#12 45.72 npm error 404
#12 45.72 npm error 404 Note that you can also install from a
#12 45.72 npm error 404 tarball, folder, http url, or git url.

Use Trusted publishing to publish our npm package using GitHub OIDC token. Also generate provenance attestation.