feat: support token-based package publishing on npm (oidc)

[jayree]

What does this PR do?

Adds support for token-based package publishing to npm using OIDC authentication. The dependency check was updated so that NPM publishing workflows that use OIDC no longer require an NPM_TOKEN environment variable. This enables CI workflows to publish packages via OIDC without supplying a classic NPM token.

      sf-release npm:package:release \
        --githubtag "$INPUTS_GITHUB_TAG" \
        --npmtag "$INPUTS_TAG" \
        --no-install \
        ${{ !secrets.NPM_TOKEN && '--oidc' || '' }} \

What issues does this PR fix or reference?