Add trusted publishing

[martincostello]

• Publish to npmjs.org from tags using npm trusted publishing.
• Pin GitHub Actions by Git SHA.
• Refactor permissions.
• Bump version to 9.0.1.

[Copilot]

Pull Request Overview

This PR implements npm trusted publishing for automated package releases and improves CI security practices. The changes enable publishing to npmjs.org from tagged releases using GitHub's OIDC-based trusted publishing feature, while also pinning GitHub Actions to specific commit SHAs for enhanced security.

• Adds npm trusted publishing workflow triggered by Git tags
• Pins GitHub Actions to specific commit SHAs for security
• Updates package version to 9.0.1

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps version from 9.0.0 to 9.0.1
.github/workflows/build.yml	Adds trusted publishing setup, pins actions to SHAs, and configures tag-based publishing

Comments suppressed due to low confidence (1)

.github/workflows/build.yml:54

• The 'Publish' step has incorrect indentation. It should be aligned with other job steps, not nested under the 'Test' step.

    - name: Publish