This extracst the publish on npm workflow from ci.yaml and adds a new workflow
called `npm-beta.yaml`.
Now we have three workflows that publish to npm.
- `npm-beta.yaml` only runs on pushes and merges into `main`
- `npm-dev.yaml` only runs on PRs into `main` with approval from
code-server-reviewers team
- `npm-brew.yaml` only runs on releases
This should fix problems we had previously where anyone could open a PR and
publish under the code-server namespace. It also separates out the workflows
based on environment and when they should run.
