fix: add `NPM_TOKEN` default of `${CI_JOB_TOKEN}`

This is recommended upstream to use the scoped `CI_JOB_TOKEN`.

However, we must allow the user to override `NPM_TOKEN` because
there are times where the `CI_JOB_TOKEN` does not have the correct
permissions.