This PR adds a GitHub Actions workflow to publish to npm registry using one-time password (OTP).

• Runs on workflow dispatch and expects a tag
• It checks that the tag follows semver pattern and version has not been published before to npm registry
• Checks that required checks have run and passed when the tag was pushed
• Uses step-security/wait-for-secrets so OTP can be sent to the workflow

It requires setting two secrets:

1. NODE_AUTH_TOKEN - this should be a Publish token for npm registry. The package should have require two-factor authentication to publish checked in the package settings.
2. SLACK_WEBHOOK_URL - this is to get notification on Slack when OTP needs to be entered. If this notification is not needed, I can remove this part from the workflow.

I have also added harden-runner to the publish job.

Examples:

1. Publish to npm registry: https://github.com/harden-runner-canary/eslint-plugin-react/actions/runs/3237008675/jobs/5303545348#step:8:1
2. Tag not in semver pattern (failed as expected): https://github.com/harden-runner-canary/eslint-plugin-react/actions/runs/3235307416/jobs/5299550718#step:5:22
3. Version already published (failed as expected): https://github.com/harden-runner-canary/eslint-plugin-react/actions/runs/3236736891/jobs/5302945983#step:5:22

@ljharb, please let me know if you have any feedback.

Signed-off-by: Varun Sharma [email protected]