Generate SLSA Build L3 provenance

Hi 👋

I'm Ian, working on behalf of Google and the Open Source Security Foundation (OpenSSF) to help open source projects to improve their supply chain security.

After some analysis tslib showed up as one of the top transitive dependencies in the JavaScript/Node ecosystem.

I would like to offer help update tslib builds to generate a SLSA Build Level 3 Provenance. The Supply chain Levels for Software Artifacts, or SLSA (salsa) framework aims to improve security in the build process by defining increasing levels of build integrity.

Now that npm supports distributing package provenance via the official npm registry, I think this would be a good time introduce provenance generation to tslib.

Given tslib is such a highly used package, I suggest generating SLSA Build L3 provenance using the Node.js Builder reusable workflow for GitHub Actions. This would provide the highest level of integrity for the build while hopefully remaining a minimal change to the existing publish.yml workflow.

Would the tslib project be open to a PR introducing these changes?

• Update publish.yml to call the Node.js builder workflow.
• README: A brief description for end-user to know how to verify the package integrity using the generated provenance.
• README: A SLSA Level 3 badge (optional)

Start with .github/workflows/publish.yaml and the Node.js Builder reusable workflow described in the issue, then review the README sections covering package distribution. Update the publish workflow for SLSA Build Level 3 provenance, document how users can verify package integrity, and add the optional SLSA badge if appropriate.