chore(ci): setup trusted publishing

[lwasser]

This pr closes #454

What:
I have done the following

• on NPM i setup OIDC / Trusted Publishing and disabled tokens for the time being (safer)
• Added a secure environment to the publish step (which is triggered on release) and added the maintainer team to have access to "approve" the final publish step. If we decide this is cumbersome, we can remove it.
• Setup this action to run after tests but only on a release. We could have a totally separate deploy action if folks prefer that. i should i could use artifacts and such but it didn't work out quite the way i wanted it to.

How:

• https://docs.npmjs.com/generating-provenance-statements
  Supports sigstore and signed releases.

Checklist:

• Documentation
• Tests
• Ready to be merged
  
• Added myself to contributors table