draft workflow with trusted publisher

[blaisep]

[blaisep]

The trusted publisher workflow seems like something done infrequently. Maybe we can recruit someone like @webknjaz to draft something since he wrote https://github.com/marketplace/actions/pypi-publish

[webknjaz]

@blaisep actually, @jezdez and I were talking about this idea at the Packaging Summit a year ago. There was a concern regarding not being able to preview and pre-approve publishing. Though, I did have ideas of how to address this (with draft releases, I think; though needs testing), just never got to experiment with this. FWIW even my guide at https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ shows how to pause a publishing workflow and wait for manual approval. Just without the ability to download the dists for inspection.