chore(ci): bump lerna & add provenance config

[dreamorosi]

Description of your changes

This PR introduces the necessary changes to publish packages to npmjs.com together with a provenance statement backed by Sigstore.

Specifically, the PR:

• bumps lerna (package used to publish) to version 6.6.2 which is the version that introduced support for the feature
• adds two permissions to the publish-npm job, according to the npm docs on the topic: https://docs.npmjs.com/generating-provenance-statements
• sets an environment variable NPM_CONFIG_PROVENANCE=true, which according to the npm docs & the lerna maintainers should instruct the script to publish a provenance statement.

Related issues, RFCs

Issue number: closes #1436

Checklist

• My changes meet the tenets criteria
• I have performed a self-review of my own code
• I have commented my code where necessary, particularly in areas that should be flagged with a TODO, or hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my change is effective and works
• The PR title follows the conventional commit semantics

Breaking change checklist

Is it a breaking change?: NO

• I have documented the migration process
• I have added, implemented necessary warnings (if it can live side by side)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[sthulb]

I see no issues with the permissions elevation after reviewing the docs