Implement trusted publishing

[konstin]

Trusted publishing allows uploading to PyPI from GitHub actions without settings a (long-lived) secret token. Instead, you configure a GitHub Actions workflow as trusted publisher. With the id-token: write permission, GitHub Actions then allows us to obtain an OpenID Connect (OIDC) token, with which we can ask PyPI for a short lived upload token just for this session. The user experiences this as credentials-free upload. See https://docs.pypi.org/trusted-publishers/ for details and https://github.com/pypa/gh-action-pypi-publish for the reference implementation.

When we are in GitHub Actions and there are no explicit credentials, we try to obtain trusted publishing credentials. This can be controlled with --trusted-publishing (always use trusted publishing, don't try anything else) and --no-trusted-publishing (skip the check).