Opt-in dist-tag permissions for npm trusted publishing

npm’s trusted publishing now includes an optional permission to manage dist‑tags via short‑lived OIDC credentials, removing the need for long‑lived tokens for tag operations. The setting is off by default and can be enabled per configuration, keeping existing token workflows unchanged.