ci(publish): use trusted publishing

Reference: https://docs.npmjs.com/trusted-publishers

[skip ci]