Publish to PyPI using OIDC trusted publishing

[Strift]

The workflow uploads with TWINE_USERNAME: __token__ and TWINE_PASSWORD: "pypi-${{ secrets.PYPI_API_TOKEN }}", which requires a long-lived secret; using PyPI Trusted Publishing (OIDC) would avoid secret injection and reduce exposure/rotation burden.

[sanders41]

@Strift you need to setup up trusted publishing on PyPI for this at https://pypi.org/manage/account/publishing/. You can copy my publish workflow if you want, it uses uv and trusted publishing: https://github.com/sanders41/meilisearch-python-sdk/blob/main/.github/workflows/pypi_publish.yml