Allow installing private npm packages if `NPM_TOKEN` is set

It looks like `NPM_TOKEN` is used in the "release" workflows, but not in [the `setup` one](https://github.com/the-guild-org/shared-config/blob/main/setup/action.yml). It is necessary when installing private dependencies.