feat: add provenance info (#5)

See https://github.blog/2023-04-19-introducing-npm-package-provenance/

Setup using instructions from
https://github.com/semantic-release/npm#npm-provenance

Fixes RET-1037

.github/workflows/workflow.yaml

@@ -71,6 +71,11 @@ jobs:
       - knip
       - test
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     steps:
       # actions/checkout MUST come before auth
       - uses: actions/checkout@v4

package.json

@@ -75,6 +75,7 @@
     "preset": "conventionalcommits"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }