chore: use OIDC for npm publishing

[CountBleck]

Also, bump the actions versions in publish.yml while we're at it.

• I've read the contributing guidelines
• I've added my name and email to the NOTICE file

[HerrCai0907]

Maybe it is also needed.

registry-url: "https://registry.npmjs.org"

[CountBleck]

Are you sure? I don't think it was needed for aspublish.

[HerrCai0907]

I am not sure whether it is needed for OIDC. since I meet some error when missing this item.

[HerrCai0907]

This is official example from https://docs.npmjs.com/trusted-publishers#github-actions-configuration

name: Publish Package

on:
  push:
    tags:
      - 'v*'

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm run build --if-present
      - run: npm test
      - run: npm publish

[HerrCai0907]

let me merge it and try to release