vocab-tools: Set repository URL in package.json

This fixes an npm publishing error (E422) by explicitly setting the
repository URL, which is required for sigstore provenance verification.

Author: dahlia