Use trusted publisher for pypi

[jsignell]

As recommended in https://github.com/stac-utils/xpystac/actions/runs/13791760524

NOTE: this might break my ability to release.

[keewis]

in my experience, this is pretty easy to switch to: you just have to remember to set up the trusted publisher on PyPI and create the pypi environment on github (which can be empty, or you can define a pattern to only allow running for specific tags). And you can always go back to token-based uploading should there be any issue that is hard to resolve in a hurry.