Prepare the deploy workflow for npm OIDC publish

[OleksiiZubko]

npm trusted publishing needs the workflow to be able to mint an OIDC token, so grant id-token: write and narrow the rest of the job to contents: read.

cache: npm is gone from a release build: a restored dependency cache is state carried over from an earlier run, and what gets published should come from a clean install only. package-manager-cache: false

Relates-To: MINOR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.9958%. Comparing base (40f9180) to head (028b331).

Additional details and impacted files

@@             Coverage Diff             @@
##             master       #543   +/-   ##
===========================================
  Coverage   90.9958%   90.9958%           
===========================================
  Files            86         86           
  Lines          2832       2832           
  Branches        390        390           
===========================================
  Hits           2577       2577           
  Misses          108        108           
  Partials        147        147           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.