Move to NPM trusted publishing

As supply chain attacks get worse, we want to move our packages to be published **only** by trusted publishing.

This package is currently allowed to publish by token:

See https://github.com/developmentseed/how/issues/475 and see https://github.com/developmentseed/deck.gl-raster/blob/main/.github/workflows/release.yml for an example of trusted publishing

Locate this repository's package release workflow and compare it with the referenced deck.gl-raster .github/workflows/release.yml example, also reviewing the linked issue for context. Update the publishing configuration so packages use trusted publishing instead of tokens, then verify the workflow and package settings no longer permit token-based publishing.

Written by the indexing model from the issue text.