Fix CI E401 by repointing lockfile to public npmjs and forcing npm ci to rewrite private-registry hosts via --replace-registry-host=always

[arpit-jn]

Changes

CI's npm ci was failing with E401 Incorrect or missing password because two core-js@3.48.0 entries in package-lock.json had resolved URLs pointing at Auth0's private Artifactory (a0us.jfrog.io), which is unauthenticated in public CI.

• package-lock.json: repointed the two core-js resolved URLs to the public registry (registry.npmjs.org); integrity hashes unchanged (identical tarballs).
• .github/workflows/build.yml and .github/actions/npm-publish/action.yml: added --replace-registry-host=always to npm ci (and set registry-url in build) so npm rewrites any private-registry host that leaks into the lockfile back to the public registry, preventing recurrence.

registry-url alone does not fix this — it only writes an .npmrc; npm still fetches from the lockfile's resolved host unless replace-registry-host rewrites it.

References

• npm config docs: https://docs.npmjs.com/cli/using-npm/config#replace-registry-host

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines in the CONTRIBUTING documentation have been run/followed
• All relevant assets have been compiled as directed in the CONTRIBUTING documentation, if applicable

[frederikprijck]

Let's use #835