[Dependency Mgmt] Set up trusted publishing for CommonGrants npm packages

[laurabelinfante]

Summary

Configure trusted publishing for CommonGrants npm packages to eliminate the need to rotate npm tokens stored in GitHub Actions. Trusted publishing lets GitHub Actions authenticate to npm without long-lived tokens. May require GitHub org admin approval. PyPI trusted publishing for common-grants-sdk is out of scope here and will be tracked separately (see #650).

Acceptance criteria

• Trusted publishing configured for CommonGrants npm packages
• Token-based npm auth removed from GitHub Actions workflows
• Required GitHub org admin approvals secured if needed
• Publishing of npm packages is verified for all packages switched to trusted publishing

References

• Related umbrella: [Release Mgmt] Security improvements #567 [Release Mgmt] Security improvements (Q7)