Remove pypi token usage

[blink1073]

trafficstars

Description

For the next major version (v3), I propose we remove support for PyPI tokens, and only support PyPI Trusted Publishing. This will mean that release-from-releaser will no longer work unless you configure the project to accept trusted publishing from your fork of jupyter_releaser.

We would drop support for PYPI_TOKEN, PYPI_TOKEN_MAP, and TWINE_USERNAME. Test PyPI also supports trusted publishing, so that part of the instructions would need to be updated.

[ElioDiNino]

This would mean that publishing from private repositories would no longer work just as a note

[blink1073]

Fair, we could keep PYPI_TOKEN and recommend against using it unless using a private repository. We would still want to get rid of TWINE_USERNAME since it should always be __token__, and still get rid of PYPI_TOKEN_MAP.