Migrate PyPI publishing to OIDC

[kelnage]

To avoid storing a PyPI API key and improve the security of your deployment workflow, we should switch to OIDC publishing. This will require either migrating our publishing workflow to the pypi-publish or using a manual workflow to request an OIDC/API token and use it in the existing publishing workflow.