Move to NPM trusted publishing

[kylebarron]

As supply chain attacks get worse, we want to move our packages to be published only by trusted publishing.

This package is currently allowed to publish by token.

See https://github.com/developmentseed/how/issues/475 and see https://github.com/developmentseed/deck.gl-raster/blob/main/.github/workflows/release.yml for an example of trusted publishing. Also ref developmentseed/deck.gl-healpix#6