Setup NPM provenance statements

[wizardlyhel]

WHY are these changes introduced?

Security requirement

WHAT is this pull request doing?

HOW to test your changes?

Post-merge steps

Checklist

• I've read the Contributing Guidelines
• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've added a changeset if this PR contains user-facing or noteworthy changes
• I've added tests to cover my changes
• I've added or updated the documentation

[shopify]

Oxygen deployed a preview of your hl-npm-provenance branch. Details:

Storefront	Status	Preview link	Deployment details	Last update (UTC)
classic-remix	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 27, 2025 9:16 PM
third-party-queries-caching	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 27, 2025 9:16 PM
metaobjects	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 27, 2025 9:16 PM
custom-cart-method	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 27, 2025 9:16 PM
Skeleton (skeleton.hydrogen.shop)	✅ Successful (Logs)	Preview deployment	Inspect deployment	January 27, 2025 9:17 PM

Learn more about Hydrogen's GitHub integration.

[rbshop]

We also need to update the various package.json files to include a repository field (from here)

[github-actions]

We detected some changes in packages/*/package.json or packages/*/src, and there are no updates in the .changeset.
If the changes are user-facing and should cause a version bump, run npm run changeset add to track your changes and include them in the next release CHANGELOG.
If you are making simple updates to examples or documentation, you do not need to add a changeset.