Upgrade PyPI CI publishing to use Trusted Publishing

[lmmx]

• Background: REL/SEC: enabling trusted publishing for PyPI specutils#1323

Migrates PyPI publishing from a long-lived API token to Trusted Publishing (OIDC), motivated by recent supply chain attacks (litellm, lightning).

The publishing step uses a reusable workflow from the OpenAstronomy org, and since you can't pass OIDC tokens across orgs, the workaround (documented here) is to instead set upload_to_pypi: false and save_artifacts: true then publish the stored artifact with the pypa/gh-action-pypi action.

• Adapted from similar PR in regions repo: Upgrade PyPI CI publishing to use Trusted Publishing regions#661 which followed this example from the astropy package repo.

The code changes here require some further (trivial) setup on the PyPI-side. Specifically, the PyPI admin (not just maintainer) needs to register the TP on PyPI at https://pypi.org/manage/project/photutils/settings/publishing/

• Owner: astropy
• Repo: photutils
• Workflow: publish.yml
• Environment: pypi

The pypi_token secret should be deleted from the repo secrets and can be invalidated on PyPI too.

(Not sure who is the PyPI admin, the maintainers are listed as @larrybradley + @astrofrog)

Closes #2250

[larrybradley]

Thanks, @lmmx!