ci(release): migrate to PyPI trusted publishing

[sisp]

I've migrated our release workflow from using PyPI access tokens to trusted publishing.

A few remarks about advice on https://docs.pypi.org/trusted-publishers/security-model/ that I've followed:

• I've created a dedicated workflow release.yml that is trusted by pypi.org. But it seems that dependence on jobs from another workflow (here, build and flake-check from ci.yml) via needs isn't supported. The only alternative I've found is dependence on the completion and success of a complete workflow via workflow_run and job.<job_id>.if: ${{ github.event.workflow_run.conclusion == 'success' }}, but I haven't found a Python project that implements this approach. I think it's sufficiently safe to assume that the tests are passing when making a release, but I'm open to hearing different opinions.
• I've limited the scope of the publishing jobs by using separate build and publish/publish-test jobs where only the latter have write permissions.
• I've created dedicated environments pypi/pypi-test scoped to tags with the name pattern v*.
• I've created tag protection rules.

As before, the distribution files are uploaded to test.pypi.org when a tag is pushed. In a follow-up PR, I plan to change this setup to upload to test.pypi.org also on the default branch (master) to test the publishing process more regularly (with some inspiration from github.com/iterative-ai/dvc:.github/workflows/build.yaml).

Todos after merging this PR:

• For pypi.org
  • Configure trusted publishing
  • Delete PyPI API token
  • Delete GHA secret
• For test.pypi.org
  • Configure trusted publishing
  • Delete PyPI API token
  • Delete GHA secret

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 97.86%. Comparing base (5657ab6) to head (8a60162).
Report is 101 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2089   +/-   ##
=======================================
  Coverage   97.86%   97.86%           
=======================================
  Files          55       55           
  Lines        5949     5949           
=======================================
  Hits         5822     5822           
  Misses        127      127           

Flag	Coverage Δ
unittests	97.86% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sisp]

Disabling this workflow for pushed tags should resolve the following problem with Codecov:

Coverage data is based on head 8e9a87f (15 uploads) compared to base f215a23 (30 uploads)

30 instead of 15 uploads are cause by the two CI runs triggered by the pushed release commit to master and the tag that references that same commit.

[pawamoy]

Thanks @sisp , looking good to me 👍