Support for npm trusted publishing

It would be nice to be able to enable "Trusted Publisher" and be able to use an alternative npm publishing workflow that handles doing trusted publishing to avoid needing to keep a NPM_TOKEN in the repository

Theres examples of how to implement trusted publishers here:
https://docs.npmjs.com/trusted-publishers

Enabling trusted publishers does require that the package exists first so it would likely need to exist alongside the existing npm publishing workflow as a option that can be turned on to switch between the versions.

Thanks for your consideration

Read the npm trusted publishing documentation linked in the issue, then locate cargo-dist's existing npm publishing workflow and the option that controls it. Compare the current NPM_TOKEN-based path with the requested trusted-publisher path; done means users can select the alternative workflow while retaining the existing option.

Written by the indexing model from the issue text.