chore(publish): add publishConfig {access:public, provenance:true}

Provenance attestation becomes a property of the package, not a
property of the workflow's --provenance CLI flag. access:public
also load-bears for first-publish of @Scoped packages on a fresh
npm registry session.

Author: jdalton

package.json

@@ -3,6 +3,10 @@
   "version": "5.27.0",
   "packageManager": "[email protected]",
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [
     "Socket.dev",