NPM publishing should use Trusted publishing for npm packages

[jbrejner]

The npm packages currently uses an api token when publishing to npmjs.org
The current ticket is monitored for expiration via secrets setup, so nothing urgent here.

For Github CI publishing npmjs.org recommends using trusted publising instead https://docs.npmjs.com/trusted-publishers