github: Opt-in dist-tag permissions for npm trusted publishing
npm trusted publishing can now optionally get permission to manage dist-tags using short-lived OIDC credentials. This covers actions like moving tags such as latest, next, and beta without using long-lived credentials.