Use a trusted publisher to release versions

[c-w-feldmann]

From the pypi docs: https://docs.pypi.org/trusted-publishers/

Security: PyPI's normal API tokens are long-lived, meaning that an attacker who compromises a package's release token can use it until its legitimate user notices and manually revokes it. Trusted Publishing avoids this problem because the tokens minted expire automatically.