Upgrade node to 22 and add provenance

[gracepark]

Doing some actions maintenance:

• Updated to Node 22 as it will be LTS by the end of the month
• Set explicit permissions in all actions
• Enabled provenance when publishing to npm