* chore: enable npm provenance * chore: do the same for dev releases * chore: actually enable it in normal releases * chore: specify provenance in `package.json` * chore: remove `publishConfig` from api-extractor-utils as it's `private`