fix(security): require OIDC for npm publishing (#2404)