3.x release process publishes to npm with "latest" dist-tag, not "latest-3" dist-tag

[trentm]

The recent 3.52.2 release took the "latest" npm dist-tag. That's wrong. "latest" should always be the current main release branch (currently 4.x), else latest-$major.

[trentm]

I accidentally blew this away in the other updates to the release.yml workflow in #4304

       - name: npm publish
         run: |-
-          echo "//registry.npmjs.org/:_authToken=${{ env.NPMJS_TOKEN }}" > .npmrc
-          npm publish --tag="latest-3" --otp=${{ env.TOTP_CODE }}
+          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
+          npm publish --provenance