ci: npm publish requires write permissions for id-token

[JamieMagee]

Changes

Gives our release-npm workflow id-token: write permissions

Context

#19170
Build currently failing with:

npm ERR! code EUSAGE
npm ERR! Automatic provenance generation not supported outside of GitHub Actions

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[secustor]

Why does it need write permissions? Does it now commit sig files back into to the repo?

[JamieMagee]

No, it's just the required permission. See the documentation:

The job or workflow run requires a permissions setting with id-token: write. You won't be able to request the OIDC JWT ID token if the permissions setting for id-token is set to read or none.

We already have this configured for our container image signing:

https://github.com/containerbase/base/blob/5af9584eb6ab9371a123aaa0422f5a62546a0307/.github/workflows/build-push.yml#L41-L44

[renovate-release]

🎉 This PR is included in version 35.55.1 🎉

The release is available on:

• GitHub release
• 35.55.1

Your semantic-release bot 📦🚀