ci: generate provenance statements when release

[kecrily]

Using npm publish --provenance, you can show the provenance in npmjs, making the whole process more transparent and easier to audit.

You can see the provenance at semver on npmjs

Ref Generating provenance statements | npm Docs

[nzakas]

Thank you for doing this! I've been wanting to investigate but didn't have time.

I'd love to do this for all of our packages that are released via release-please.

Leaving open for a couple of days for others to review.

[kecrily]

I will extend it to all packages under eslint