Support NPM OTP token

### Problem

NPM package can't be published with `publib` when 2FA is configured in the target NPM account.

### Details

`npm publish` command used in `publib-npm` ([source](https://github.com/cdklabs/publib/blob/d5ac30071067aa38a10b661f62aa87d147bc46cd/bin/publib-npm#L75)) requires an `--opt` flag when 2FA is configured. There's no equivalent env variable according to [NPM docs](https://docs.npmjs.com/cli/v7/commands/npm-publish#otp).

### Workaround

I was able to publish an NPM package by editing `publib` sources in `node_modules`. I added the `--otp` flag in `node_modules/.bin/publib-npm`:

```bash
npm publish ${tag} ${access} ${file} --otp 2>&1 | tee ${log}
```

### Suggested Solution

An `NPM_OTP_TOKEN` env variable could be supported by `publib` and used as the `--otp` flag value in the `npm publish` command. This won't be the optimal solution, though, as the OTP token is short-lived and will have to be updated right before running the `publib` command. A better solution would be to somehow allow `npm publish` to run in interactive mode and prompt the user for the OTP token. ([see NPM OTP option docs](https://docs.npmjs.com/cli/v7/commands/npm-publish#otp)).

Start with bin/publib-npm around the npm publish invocation referenced in the issue, then inspect the surrounding publishing flow and existing tests. Compare the proposed environment-variable and interactive approaches against the npm OTP behavior. Done means publishing with a 2FA-enabled npm account can receive an OTP through a documented, tested path.

Written by the indexing model from the issue text.