ci: publish through trusted publishing instead of a stored npm token

ci: publish through trusted publishing instead of a stored npm token #2