Set up trusted publisher for npmjs

[so0k]

classic tokens will be retired by December 9

refer to:

• https://docs.npmjs.com/trusted-publishers
• https://projen.io/docs/publishing/trusted-publishing