ci: publish npm package with provenance

[mcc0nnell]

Summary

Publish the FlatBuffers npm package with npm provenance.

The existing release job already runs on a GitHub-hosted runner and publishes directly with npm publish. This change grants only the npm publishing job id-token: write and adds --provenance, allowing npm to attach Sigstore-backed provenance to the package while preserving the existing npm token authentication flow.

Why

The current npm release has a registry signature but no provenance attestation:

$ npm view flatbuffers@25.9.23 dist.attestations --json
# no value

$ npm view flatbuffers@25.9.23 dist.signatures --json
# registry signature present

npm provenance gives downstream consumers a verifiable link between the published package, this GitHub repository, and the workflow that built/published it. It complements the registry signature rather than replacing it.

The package metadata already points at https://github.com/google/flatbuffers.git, which satisfies npm's public-repository requirement for provenance.

Scope

• no package contents change
• no registry migration
• no secret replacement
• no changes to the other release ecosystems
• permissions are scoped to the publish-npm job

Validation

• git diff --check: PASS
• npm pack --dry-run --ignore-scripts: PASS
  • package: flatbuffers@25.12.19
  • generated package: flatbuffers-25.12.19.tgz
• actionlint reports the same pre-existing actions-rs/toolchain@v1 obsolete-runner error on both upstream master and this branch; this patch introduces no new actionlint finding.

npm provenance documentation:
https://docs.npmjs.com/generating-provenance-statements/