npm: mention generating provenance statements

[UlisesGascon]

npm recently introduces the Generating provenance statements. I think it will be a good idea to include a reference in the release section

Should I create a PR for that?

cc: @lirantal @ljharb

[ljharb]

I really don't think it's a good idea to recommend or link to it yet. Publishing from CI is very unsafe unless using actual two-factor (an automation token is one-factor), and it remains unclear to me what the value of provenance even is, since I'm not aware of any actual incidents it would have prevented.