feat(ci/cd): switch to `npm` trusted publishing

Fixes #325 This PR is to switch `npm` publish from token-based to trusted publishing, eliminates long-lived token for longevity. However, the project's maintainer needs to walk through this [section](https://docs.npmjs.com/trusted-publishers#configuring-trusted-publishing) to setup necessary config on `npm` side, as this PR is to implement 2nd part. Once the PR is merged and packages version 8.x got released, it'll resolve a breed of issue on deprecated `glob` and `inflight` package.