ci: publish to npm via trusted publishing instead of a stored token

ci: publish to npm via trusted publishing instead of a stored token #1192