Enhancement: publish packages directly to npm, including provenance

[lovell]

This will remove the use of GitHub releases (git tags will remain).

https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions

[lovell]

Publishing directly to npm from GitHub Actions would remove the ability to use 2FA so I'm unsure we should go down this route at the moment. If GitHub Actions improves support for this, e.g. prompt for an OTP in the middle of a job, then I'll revisit.

[lovell]

Commit 2f4e976 brings the process much closer to the approach outlined here.

Previously a bunch of platform-specific tarballs were attached to a GitHub release, with a version number that tried to follow the upstream libvips. Now we can control our own sharp-libvips versioning independently of libvips and attach a single tarball containing the fully-populated npm workspace for each release.

This means I can download a single file, untar it, run npm publish --workspaces, provide an OTP and it should Just Work™.

[lovell]

The latest npm v11.5.1 provides the missing puzzle piece - the same OIDC-based, short-lived token approach that other registries such as PyPI already support - https://docs.npmjs.com/trusted-publishers

Commit to enable this - b2579c9

Example package published with provenance - @img/sharp-libvips-linux-x64@1.2.2-rc.1