Use Trusted Publishers for publishing releases to PyPI

[matthewfeickert]

At the moment uproot still uses long lived API token based publishing to PyPI

uproot5/.github/workflows/deploy.yml

Lines 43 to 45 in 734700e

	- uses: pypa/gh-action-pypi-publish@release/v1
	with:
	password: ${{ secrets.pypi_password }}

It would be preferable from a security and long term security maintenance view (c.f. scientific-python/summit-2024#9) to use Trusted Publishers for this.

Given that adding a trusted publisher to an existing PyPI project requires owner level control of the PyPI project, I can't make the necessary changes to enable this, but c.f. the following PRs as examples of what is needed after the fact:

• ci: Use PyPI Trusted Publisher for publishing package pyhf#2183
• ci: publish to PyPI with OIDC awkward#2450