feat: use npm trusted publishing with OIDC

[jaseemjaskp]

Summary

This PR updates the publish workflow to use npm Trusted Publishing with OIDC instead of long-lived access tokens.

Changes

• Add id-token: write permission at workflow level (required for OIDC)
• Remove NODE_AUTH_TOKEN environment variable (not needed with trusted publishing)
• Simplified npm publish command (provenance is auto-generated with trusted publishing)

Benefits

• Enhanced Security: No more storing, rotating, or risking exposure of npm tokens
• Automatic Provenance: Trusted publishing auto-generates provenance attestations
• Short-lived Credentials: Each publish uses workflow-specific credentials that cannot be exfiltrated

Requirements

Before merging, ensure the trusted publisher is configured on npmjs.com:

1. Navigate to package settings on npmjs.com
2. Add a trusted publisher with:
   • Organization: Zipstack
   • Repository: n8n-nodes
   • Workflow: publish.yml

References

• npm Trusted Publishing Docs
• GitHub Changelog Announcement