When someone with a public repository and a private package attempts to publish with OIDC, the publish command will fail because provenance is enabled, there is currently no visibility check before auto enabling provenance.

This is a very rare edge case, but it's still incorrect. OIDC will always gracefully fail, but provenance does not.

• This fix adds all the provenance related code after the OIDC auth token is set.
• This requires provenance to be in the default config state (not set by the user) for OIDC to even consider auto-enabling provannece.