fix: publish via npm trusted publisher (OIDC)

[YuryShkoda]

Issue

sasjs/utils publishes to npm via cycjimmy/semantic-release-action authenticated with a long-lived NPM_TOKEN secret. Long-lived publish tokens are a standing credential-leak risk.

Intent

Publish to npm using short-lived OIDC credentials instead of a static NPM_TOKEN, while keeping the same semantic-release versioning/changelog behavior.

Implementation

• .github/workflows/publish.yml: replaced the cycjimmy/semantic-release-action step with a direct npx semantic-release call, and added an explicit npm publish --access public step that authenticates via OIDC (id-token: write permission, npm upgraded to latest since Node 22 ships npm 10.x and trusted publishing needs ≥ 11.5.1). A short-lived GitHub App token (secrets.APP_ID / APP_PRIVATE_KEY) is minted per run to check out the repo and push semantic-release's version-bump commit past branch protection, replacing secrets.GITHUB_TOKEN.
• package.json: expanded the release config from a bare branches list to the explicit plugin pipeline (commit-analyzer, release-notes-generator, exec to bump the version, git to commit package.json/package-lock.json back, github for release notes) — the same pipeline cycjimmy/semantic-release-action ran implicitly, now made explicit since semantic-release is invoked directly. Added semantic-release, @semantic-release/exec, and @semantic-release/git as devDependencies.

Checks

• Code is formatted correctly (npm run lint:fix).
• All unit tests are passing (npm test).
• All sasjs-cli unit tests are passing (npm test).
• Reviewer is assigned.

Reviewer checks

• Any new code is documented.

[allanbowe]

Closes #260 (hopefully)

[sasjs-gha]

🎉 This PR is included in version 3.5.9 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀