github: Fix JavaScript publish workflow permissions

The workflow enables npm's provenance feature, which requires write
permissions to the "id-token" on Github actions:

https://tsmx.net/npmjs-built-and-signed-on-github-actions/

.github/workflows/napi.yml

@@ -205,6 +205,9 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - test-macOS-windows-binding
       - test-linux-x64-gnu-binding