ci: refactor workflows to support trusted publishing / OIDC

[ryepup]

Proposed changes

The existing workflow had a few quirks:

• combined PRs and merging to main, creating a broader attack surface
• published to npm and then made a git tag. If the git step failed we might have a published package version without a matching tag.
• relied on some github default permissions that could get overridden at the org level to improve security.
• tried to npm publish when our dev dependencies change, and failed because the package version was already there. This was some useless noise.

Given the recent spate of npm supply chain attacks, I wanted to revamp this and get a little more explicit.

• split up the PR, tag, and npm publish to three workflows with their own explicit permissions
  • the PR workflow runs build/test (reads git)
  • the tag workflow creates a tag after merging to main (read/write to git)
  • the publish workflow uses trusted publishing to publish the package (reads git, writes to npm)
• disable caching during npm publish to dodge the cache poisoning attacks like https://tanstack.com/blog/npm-supply-chain-compromise-postmortem. I don't think we were vulnerable to the same things, but github actions is kinda a mess security wise so I'm feeling paranoid
• tweak the tag script to be a no-op if the package.json version hasn't changed.

fixes #490, fixes #26

Also adds an explicit dependency to tslib to try to get the workflows to actually pass. See #546

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING document
• If applicable, I have added tests that prove my fix is effective or that my feature works
• If applicable, I have checked that any relevant tests pass after adding my changes
• I have updated any relevant documentation (README.md and CHANGELOG.md)