TODO: Consider Trusted Publishing

[abravalheri]

The benefits of PEP 740 are you get SigStore attestations for the artifacts on PyPI & there's no password or long-lived token to leak. You just set it up on PyPI and then use the action.

• https://docs.pypi.org/trusted-publishers/
• https://learn.scientific-python.org/development/guides/gha-pure/ (near bottom of page)
• https://sethmlarson.dev/python-and-sigstore

Originally posted by @henryiii in https://github.com/abravalheri/validate-pyproject/pull/237#discussion_r1994044340