Harden NPM configuration and CI/CD

As a GSA FedRAMP member, I would like to ensure we harden the operations and security around the CI/CD system for this repository. At a minimum to start:

- [ ] Perform a lightweight threat model of this tool and its CI/CD
- [ ] Triage initial first-pass concerns and changes
- [ ] We need to properly tag in GitHub all package releases that are extant in NPMJS so engineers and security-minded devs and auditors can know which exact commit matches the installed version verbatim when they install. Sorry, we need to go back and pin all 42.
- [ ] I want to create a user or system account owned by supervisor level staff in NPMJS and use that token for deploys to NPM (most of the FedRAMP Auto Team should not have access, this is for break glass purposes only to retrieve the token)
- [ ] We should enable [release attestation](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) in CI/CD for NPMJS to pick up
- [ ] We need to [enable branch rules](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) on `main` and maybe others given the threat model discussion