Continuous enforcement of 2FA for publishing packages

Nobody has claimed this yet.

All NPM packages under our purview were manually reviewed to ensure that 2FA was enforced for publishing these packages. Currently, this is being done manually by reviewing each package individually through `npmjs.com`.

There is currently no way to do an organisation-wide 2FA publishing enforcement nor a way to programmatically retrieve the current packages' 2FA publishing requirement, though there seems to be some future plans.

From https://github.blog/2021-12-07-enrolling-npm-publishers-enhanced-login-verification-two-factor-authentication-enforcement/:

> We are currently working on a variety of enhancements to the registry to make 2FA adoption easier for developers, including:
> ...
> * Better tools for understanding 2FA adoption in npm orgs

However, we can still programmatically enable 2FA for package publishing using [`libnpmsaccess`](https://github.com/npm/cli/tree/f66290ecbbc1f766597013ed0d8e624455372de4/workspaces/libnpmaccess) through a scheduled GitHub Action Workflow. While a "mitigative" solution, it reduces the attack window in case of an accidental disabling of this publishing requirement.

This proposed solution does not:

- Prevent disabling of 2FA publishing requirement
- Provide visibility when a 2FA publishing requirement is disabled

Start with the proposed scheduled GitHub Actions workflow and the libnpmsaccess documentation linked in the issue. Determine how package publishing 2FA can be enabled programmatically and which packages and credentials the workflow must cover. Done means the scheduled enforcement is implemented and its limitations around disabling and visibility are documented.

Written by the indexing model from the issue text.