Use npm staged publishing

[remcohaszing]

Initial checklist

• I understand this is a feature request and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Problem

The JavaScript community is under attack. We can take action to harden our publishing pipeline, so IMO we should.

Solution

Use staged publishing. This adds a 2FA to the publish flow.

Alternatives

N/A