Migrate npm publishing to OIDC

[pomek]

🚀 Summary

Migrates the release workflow from the long-lived CKE5_NPM_TOKEN to npm Trusted Publishing with CircleCI OIDC.

The PR also:

• Installs npm ^11.11.0 in the release job because the cimg/node:24.11.0 image ships an npm version whose OIDC implementation does not recognize CircleCI (support was added in feat: adds circleci to oidc npm/cli#8925, first released in npm 11.11.0).
• Configures releaseTools.publishPackages() to use OIDC (useOidc: true) and removes the login-based npmOwner option, as npm whoami does not support OIDC authentication.
• Triggers the trusted GitHub App pipeline definition during releases (--pipeline-definition-id).
• Switches the origin remote to SSH and pins GitHub's published Ed25519 host key so the release commit and tag can be pushed from the GitHub App checkout without an interactive prompt.
• Adds a focused script test verifying the OIDC option and the absence of npmOwner.

The changes mirror the Mrgit and Umberto migrations driven by ckeditor/ckeditor5-internal#4432.

---

📌 Related issues

• Closes https://github.com/ckeditor/ckeditor5-internal/issues/4651.

---

💡 Additional information

This is an internal CI change, so no changelog entry is required. ESLint and script tests pass locally, and the trusted publisher configuration inputs (organization, project, and pipeline definition IDs) were verified against the CircleCI API. Before the first release on this flow, a trusted publisher for @ckeditor/ckeditor5-react must be configured on npm, and a release after merge is required to validate the OIDC exchange with npm end to end.