chore: add .npmrc to not use a package-lock and to include package provenance to improve security