Enable NPM provenance

[hasezoey]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the feature has not already been requested

🚀 Feature Proposal

Enable npm provenance when publishing.
This will provide a attestation of where and on what commit a given publish was build on.

Additionally, i dont know if this applies to the current publishing process, but maybe also consider enabling Trusted Publishing if possible.

Motivation

From NPM docs:

This allows you to publicly establish where a package was built and who published a package, which can increase supply-chain security for your packages.

Example

At least for typegoose it was easy to add by just enabling npm publish option --provenance, or using publishConfig:

{
  "publishConfig": {
    "access": "public",
    "provenance": true
  }
}

A example of how it is shown can be seen via the typegoose package.
Or as images:

[vkarpov15]

This is a great suggestion, will set this up. I've been meaning to set up automated publishing from GitHub actions anyway.