Update GitHub Actions for npm provenance