docs: add instructions on using "trusted publishers" on PyPI

[hollandjg]

... rather than tokens.

• https://docs.pypi.org/trusted-publishers/
• https://github.com/marketplace/actions/pypi-publish
• https://github.com/INTERSECT-training/packaging/blob/main/_episodes/09-publishing-citations.md