Enable immutable releases

[bcomnes]

Since this package leverages downloads off GitHub actions, it would be beneficial to enable the immutable release option so that releases can't be swapped out by a malicious account takeovers.

[bcomnes]

Actually, this might not be the right solution. My security scanner is getting pissed about:

https://github.com/pb33f/openapi-changes/blob/main/npm-install/postinstall.js#L24

Updating off mutable identifiers can lead to some really bad security events if the target is ever compromised.