Trusting publishers using OpenID Connect instead of tokens: https://docs.npmjs.com/trusted-publishers
