Ecosystem break: ability to detect trusted publishing lost for staged publishes

Many tools in the ecosystem use the `_npmUser` of a packument to know if a package was created via trusted publishing or not. When it is, the npm user is the oidc user. However, now that staging is a thing - the npm user will correctly be the human who approved the publish rather than the automation. This means there's no longer any way to determine if a package was published via oidc or not. **Due to this, many existing tools in the ecosystem incorrectly detect staged packages as decreasing in trust level**. E.g. this breaks pnpm's trust downgrade check which will fail some installs iirc Npm is technically doing the right thing here, so the solution is probably to introduce new metadata somewhere to signal when oidc was used.