Enable npm package provenance

[bedrich-schindler]

See: https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/

This significantly improves our image and security as well.