--provenance
Similar to how we do it upstream: e2c8163b14/utils/publish_all_packages.sh (L97) Reference: https://docs.npmjs.com/generating-provenance-statements
e2c8163b14/utils/publish_all_packages.sh (L97)
Requires the `NPM_TOKEN` secret to be set.