ci: Add npm publish with trusted publishing to gnd build workflow

Update the gnd binary build workflow with:
- Replace deprecated macos-13 runner with macos-14
- Bump GitHub Actions to Node.js 24-compatible versions
- Cache gnd binaries to skip builds when source is unchanged
- Use --clobber for release asset uploads
- Add publish-npm job that publishes per-platform @graphprotocol/gnd-*
  packages using npm trusted publishing (OIDC, no NPM_TOKEN needed)
- Support --tag for prerelease npm publishes
- Add dry_run workflow input for testing