Support for PyPI Trusted Publisher

[jtpio]

Problem

PyPI now seems to support ublishing to PyPI with a Trusted Publisher: https://docs.pypi.org/trusted-publishers/

Proposed Solution

Maybe this can help simplify even more the release process and avoid creating a token for publishing to PyPI. Especially for Python only projects.

Additional context

Maybe the releaser already supports this by default without requiring any changes.

At least for the projects using the workflows from the repo. It would probably be trickier to set up when making releases from a fork of the jupyter-releaser.

In that case maybe just documenting this would be enough.

[jtpio]

Maybe the releaser already supports this by default without requiring any changes.

Actually not sure if this would only work with the pypa/gh-action-pypi-publish@release/v1 GitHub Action maybe : https://docs.pypi.org/trusted-publishers/using-a-publisher/

[blink1073]

I'm thinking we should modify the publish action example to use pypa/gh-action-pypi-publish@release/v1 and the OIDC token. We can still support manual upload in the releaser fork. Note that we'd also need there to be separate publishing directories for npm and pypi, since gh-action-pypi-publish accepts a packages-dir and will attempt to upload everything in it.