ci: enable provenance

[GauBen]

Description

• yarn 4.10.3 -> yarn 4.12.0
• Added --provenance to npm publish
• Fixed repository urls

Tests

The following are included in this PR

• Unit Tests (Most changes should have unit tests)
• Integration Tests

Checklist

I have considered the following implications of my change:

• Security (in particular for changes to authentication, authorization, data fetching, ...)
• Performance
• Migration
• Code maintainability

Documentation

• Inline documentation
• Internal Documentation (wiki)
• User-facing Documentation

[Copilot]

Pull request overview

This PR enables npm package provenance by adding the --provenance flag to npm publish commands and updates the project's Yarn version from 4.10.3 to 4.12.0. It also fixes malformed GitHub repository URLs.

Key changes:

• Updated Yarn from version 4.10.3 to 4.12.0 across the project
• Added --provenance flag to all npm publish commands in Maven POM files
• Corrected GitHub repository URLs from github.com: to github.com/

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
vite-plugin/pom.xml	Added --provenance flag to alpha and release npm publish commands
vite-plugin/package.json	Fixed GitHub repository URL format
tests/package.json	Updated packageManager to yarn@4.12.0
tests/.yarnrc.yml	Updated yarnPath to yarn-4.12.0.cjs
package.json	Updated packageManager to yarn@4.12.0
javascript-modules-library/pom.xml	Added --provenance flag to alpha and release npm publish commands
javascript-modules-library/package.json	Fixed GitHub repository URL format
javascript-create-module/pom.xml	Added --provenance flag to alpha and release npm publish commands
javascript-create-module/package.json	Fixed GitHub repository URL format
.yarnrc.yml	Updated yarnPath to yarn-4.12.0.cjs
.github/workflows/on-release.yml	Added id-token write permission for provenance support
.github/workflows/on-merge.yml	Added id-token write permission for provenance support

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[x0h01]

With:

• Jahia 8.2.3.0 [Kimchi] - Build: 0e47150
• dx:org.jahia.modules/javascript-modules-engine/1.1.0.SNAPSHOT (Git-last-commit-id: 0b268ab)
• @jahia/create-module@1.1.0-alpha-20251217115503239

• ✅️ no compilation errors during module build and publishing
• ✅️ integration tests passed
• ✅️ A minimal Hello World template set is created without errors
• ✅️ hydrogen module is successfully imported to jahia
• ✅️ no errors in browser console and jahia.log

• ✅️ package is built and published with provenance