use trusted publishing for dev releases

[IlyasShabi]

What does this PR do?:
Fix dev publish action by using OIDC similar to tag releases

Motivation:

Failed main action: https://github.com/DataDog/pprof-nodejs/actions/runs/23505573240/job/69495441193

[github-actions]

Overall package size

Self size: 2.01 MB
Deduped: 2.37 MB
No deduping: 2.37 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | source-map | 0.7.6 | 185.63 kB | 185.63 kB | | pprof-format | 2.2.1 | 163.06 kB | 163.06 kB | | node-gyp-build | 3.9.0 | 8.81 kB | 8.81 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[r1viollet]

LGTM

[IlyasShabi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fab9fd12b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore read access when enabling OIDC permissions

This job now sets permissions to only id-token: write, which revokes all other GITHUB_TOKEN scopes by default; GitHub docs note unspecified scopes become none, and actions/checkout recommends contents: read for proper operation. In environments where anonymous repository reads are not available (for example private repos or stricter org token policies), the checkout/download path in this job can fail with authorization errors before npm publish runs, so contents: read should be added back alongside id-token: write.

Useful? React with 👍 / 👎.

[r1viollet]

LGTM