Add permission to generate OIDC tokens for npm-publishing workflow

[anderson4j]

Following this tutorial: https://docs.npmjs.com/trusted-publishers

I've set up trusted publishing for the npm packages on npmjs - could be worth logging into our account and checking that this looks correct. The final part needed is this small permission change on the workflow, as well as making sure we run npm cli >= 11.5.1

Closes LS-49

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1285016

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[anderson4j]

This step is added so we get a new enough node version. When I tested on my own repo, the default was using node 20, and thus too low a npm version (10.x.y)
See this run for what we get when adding this "uses"-step
https://github.com/anderson4j/clonedLangSupp/actions/runs/19966528562/job/57259666256

As you can see, the npm version becomes 11.6.2 > 11.5.1, which is what we need according to the npm page for trusted publishing

[anderson4j]

I replaced this with the more correct approach of changing the setup-and-build action

[anderson4j]

This was highest release on npm. I would've thought this version was 1-1 with node version based on the old version, but I suppose not. Using this works though