Publish the npm package via GitHub Actions

[glepretre]

npm is introducing stricter security requirements for package publishing.

In particular:

• npm is deprecating TOTP-based 2FA in favor of WebAuthn/passkeys. This includes physical FIDO2 security keys as well as supported platform authenticators such as Touch ID, Face ID, or Windows Hello. See npm's security changes announcement.
• Classic npm tokens have already been revoked.
• Granular access tokens configured to bypass 2FA are also being restricted, and npm is targeting January 2027 for removing their ability to publish packages directly. See npm's announcement about the deprecation of bypass-2FA tokens.
• For automated publishing, npm recommends migrating to Trusted Publishing using OIDC. GitHub Actions and GitLab CI/CD are supported providers. See the npm Trusted Publishing documentation.

We should therefore set up GitHub Actions to publish new versions of formol to npm using Trusted Publishing.

Requirements

• Add a GitHub Actions workflow using npm Trusted Publishing / OIDC.
• The workflow must be triggered manually (workflow_dispatch) for now; no automatic publishing on tags, merges, or releases.
• Only repository members with write access should be able to trigger the workflow. GitHub requires write access to manually run a workflow_dispatch workflow. See the GitHub documentation on manually running workflows.
• Restrict publishing to the appropriate branch (e.g. main).
• Document the complete release and publishing procedure in the README so maintainers know how to publish a new version.